Proof Theory in Computer Science, PTCS 2001

Lecture Notes in Computer Science Edited by G. Goos, J. Hartmanis, and J. van Leeuwen 2183 3 Berlin Heidelberg New Y...

Author: Reinhard Kahle | Peter Schroeder-Heister | Robert Stärk

25 downloads 633 Views 2MB Size Report

This content was uploaded by our users and we assume good faith they have the permission to share this book. If you own the copyright to this book and it is wrongfully on our website, we offer a simple DMCA procedure to remove your content from our site. Start by pressing the button below!

Report copyright / DMCA form

DOWNLOAD PDF

Lecture Notes in Computer Science Edited by G. Goos, J. Hartmanis, and J. van Leeuwen

2183

3

Berlin Heidelberg New York Barcelona Hong Kong London Milan Paris Tokyo

Reinhard Kahle Peter Schroeder-Heister Robert St¨ark (Eds.)

Proof Theory in Computer Science International Seminar, PTCS 2001 Dagstuhl Castle, Germany, October 7-12, 2001 Proceedings

13

Series Editors Gerhard Goos, Karlsruhe University, Germany Juris Hartmanis, Cornell University, NY, USA Jan van Leeuwen, Utrecht University, The Netherlands Volume Editors Reinhard Kahle Peter Schroeder-Heister Universit¨at T¨ubingen Wilhelm-Schickard-Institut f¨ur Informatik Sand 13, 72076 T¨ubingen, Germany E-mail: {kahle/psh}@informatik.uni-tuebingen.de Robert St¨ark ETH Z¨urich, Theoretische Informatik ETH Zentrum, 8092 Z¨urich, Switzerland E-mail: [email protected]

Cataloging-in-Publication Data applied for Die Deutsche Bibliothek - CIP-Einheitsaufnahme Proof theory in computer science : international seminar ; proceedings / PTCS 2001, Dagstuhl Castle, Germany, October 7 - 12, 2001. Reinhard Kahle ... ed.). - Berlin ; Heidelberg ; New York ; Barcelona ; Hong Kong ; London ; Milan ; Paris ; Tokyo : Springer, 2001 (Lecture notes in computer science ; Vol. 2183) ISBN 3-540-42752-X

CR Subject Classification (1998): F.4.1, I.2.3, F.4, F.3, I.2, F.2 ISSN 0302-9743 ISBN 3-540-42752-X Springer-Verlag Berlin Heidelberg New York This work is subject to copyright. All rights are reserved, whether the whole or part of the material is concerned, specifically the rights of translation, reprinting, re-use of illustrations, recitation, broadcasting, reproduction on microfilms or in any other way, and storage in data banks. Duplication of this publication or parts thereof is permitted only under the provisions of the German Copyright Law of September 9, 1965, in its current version, and permission for use must always be obtained from Springer-Verlag. Violations are liable for prosecution under the German Copyright Law. Springer-Verlag Berlin Heidelberg New York a member of BertelsmannSpringer Science+Business Media GmbH http://www.springer.de © Springer-Verlag Berlin Heidelberg 2001 Printed in Germany Typesetting: Camera-ready by author, date conversion by PTP Berlin, Stefan Sossna Printed on acid-free paper SPIN 10840525 06/3142 543210

Preface

Proof theory has long been established as a basic discipline of mathematical logic. It has recently become increasingly relevant to computer science. The deductive apparatus provided by proof theory has proved useful for metatheoretical purposes as well as for practical applications. Thus it seemed to us most natural to bring researchers together to assess both the role proof theory already plays in computer science and the role it might play in the future. The form of a Dagstuhl seminar is most suitable for purposes like this, as Schloß Dagstuhl provides a very convenient and stimulating environment to discuss new ideas and developments. To accompany the conference with a proceedings volume appeared to us equally appropriate. Such a volume not only ﬁxes basic results of the subject and makes them available to a broader audience, but also signals to the scientiﬁc community that Proof Theory in Computer Science (PTCS) is a major research branch within the wider ﬁeld of logic in computer science. Therefore everybody invited to the Dagstuhl seminar was also invited to submit a paper. However, preparation and acceptance of a paper for the volume was not a precondition of participating at the conference, since the idea of a Dagstuhl seminar as a forum for spontaneous and open discussions should be kept. Our idea was that the papers in this volume should be suitable as starting points for such discussions by presenting fundamental results which merit their publication in the Springer LNCS series. The quality and variety of the papers received and accepted rendered this plan fully justiﬁed. They are a state-of-theart sample of proof-theoretic methods and techniques applied within computer science. In our opinion PTCS focuses on the impact proof theory has or should have on computer science, in particular with respect to programming. Major divisions of PTCS, as represented in this volume, are the following: 1. The proofs as programs paradigm in general 2. Typed and untyped systems related to functional programming 3. Proof-theoretic approaches to logic programming 4. Proof-theoretic ways of dealing with computational complexity 5. Proof-theoretic semantics of languages for speciﬁcation and programming 6. Foundational issues This list is not intended to be exclusive. For example, there is undoubtedly some overlap between Automated Deduction and PTCS. However, since Automated Deduction is already a well-established subdiscipline of logic in computer science with its own research programs, many of which are not related to proof theory, we did not include it as a core subject of PTCS. In the following, we brieﬂy address the topics of PTCS mentioned and indicate how they are exempliﬁed in the contributions to this volume.

VI

Preface

1. The most intrinsic relationship between proof theory and computer science, if proof theory is understood as the theory of formal proofs and computer science as the theory of computing, is provided by the fact that in certain formalisms proofs can be evaluated (reduced) to normal forms. This means that proofs can be viewed as representing a (not necessarily deterministic) program for their own evaluation. In particular contexts they allow one to extract valuable information, which may be given, e.g., in the form of particular terms. The idea of considering proofs as programs, which in the context of the typed λ-calculus is known as the Curry-Howard-correspondence, is a research program touched upon by most contributions to this volume. The papers by Baaz & Leitsch and by Berger are directly devoted to it. Baaz & Leitsch study the relative complexity of two cut elimination methods and show that they are intrinsically diﬀerent. Berger investigates a proof of transﬁnite induction given by Gentzen in order to extract algorithms for function hierarchies from it. 2. Functional programming has always been at the center of interest of proof theory, as it is based on the λ-calculus. Extensions of the typed λ-calculus, in particular type theories, lead to powerful frameworks suitable for the formalization of large parts of mathematics. The paper by Alt & Artemov develops a reﬂective extension of the typed λ-calculus which internalizes its own derivations as terms. Dybjer & Setzer show how indexed forms of inductive-recursive deﬁnitions, which would enable a certain kind of generic programming, can be added to Martin-L¨ of type theory. The main proof-theoretic paradigm competing with type theory is based on type-free applicative theories and extensions thereof within Feferman’s general program of explicit mathematics. In his contribution, Studer uses this framework in an analysis of a fragment of Java. In particular, he manages to proceed without impredicative assumptions, thus supporting a general conjecture by Feferman. 3. Logic programming, which uses the Horn clause fragment of ﬁrst-order logic as a programming language, is a natural topic of PTCS. Originally it was not developed within a proof-theoretic framework, and its theoretical background is often described in model-theoretic terms. However, it has turned out that a prooftheoretic treatment of logic programming is both nearer to the programmer’s way of thinking and conceptually and technically very natural. It also leads to strong extensions, including typed ones which combine features of functional and logic programming. In the present volume, Elbl uses proof-theoretic techniques to give “metalogical” operators in logic programming an appropriate rendering. 4. The machine-independent characterization of classes of computational complexity not involving explicit bounds has recently gained much attention in proof theory. One such approach, relying on higher-type functionals, is used in Aehlig et al.’s paper to characterize the parallel complexity class NC. Another prooftheoretic method based on term rewriting is applied by Oitavem in her characterization of PSPACE and is compared and contrasted with other implicit characterizations of this class. Gordeew asks the fundamental question of whether functional analysis may serve as an alternative framework in certain subjects of PTCS. He suggests that non-discrete methods may provide powerful tools

Preface

VII

for dealing with certain computational problems, in particular those concerning polynomial-time computability. 5. Besides the systematic topics mentioned, the study of speciﬁc languages is an important aspect of PTCS. In his contribution, Schmitt develops and studies a language of iterate logic as the logical basis of certain speciﬁcation and modeling languages. Studer gives a denotational semantics of a fragment of Java. By interpreting Featherweight Java in a proof-theoretically speciﬁed language he shows that there is a direct proof-theoretic sense of denotational semantics which diﬀers both from model-theoretic and from domain-theoretic approaches. This shows that the idea of proof-theoretic semantics discussed in certain areas of philosophical and mathematical logic, is becoming fruitful for PTCS as well. 6. Finally, two papers concern foundational aspects of languages. Baaz & Ferm¨ uller show that in formalizing identity, it makes a signiﬁcant diﬀerence for uniform provability, whether identity is formulated by means of axioms or by means of a schema. The paper by Doˇsen & Petri´c presents a coherence result for categories which they call “sesquicartesian”, contributing new insights into the equality of arrows (and therefore into the equality of proofs and computations) and its decidability. We thank the authors and reviewers for their contributions and eﬀorts. We are grateful to the Schloß Dagstuhl conference and research center for acting as our host, and to Springer-Verlag for publishing these proceedings in their LNCS series. The second and the third editor would like to add that it was Reinhard Kahle’s idea to organize a Dagstuhl seminar on PTCS, and that he had the major share in preparing the conference and editing this volume. He would have been the ﬁrst editor even if his name had not been the ﬁrst alphabetically. October 2001

Reinhard Kahle Peter Schroeder-Heister Robert St¨ ark

VIII

Program Committee

Program Committee Arnold Beckmann (M¨ unster) Roy Dyckhoﬀ (St. Andrews) Rajeev Gor´e (Canberra) Gerhard J¨ ager (Bern) Reinhard Kahle (T¨ ubingen) Dale Miller (Penn State) Tobias Nipkow (M¨ unchen) Frank Pfenning (Pittsburgh) Peter Schroeder-Heister (T¨ ubingen) Robert St¨ ark (Z¨ urich)

Additional Reviewers Steve Bellantoni (Toronto) Norman Danner (Los Angeles) Lew Gordeew (T¨ ubingen) Peter Hancock (Edinburgh) J¨ org Hudelmaier (T¨ ubingen) Jim Lambek (Montreal) Daniel Leivant (Bloomington) Jean-Yves Marion (Nancy) Ralph Matthes (M¨ unchen) Hans J¨ urgen Ohlbach (M¨ unchen) Christine Paulin-Mohring (Paris) Thomas Strahm (Bern)

Table of Contents

Linear Ramiﬁed Higher Type Recursion and Parallel Complexity . . . . . . . . . Klaus Aehlig, Jan Johannsen, Helmut Schwichtenberg, Sebastiaan A. Terwijn

2

Reﬂective λ-Calculus . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 Jesse Alt, Sergei Artemov A Note on the Proof-Theoretic Strength of a Single Application of the Schema of Identity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38 Matthias Baaz, Christian G. Ferm¨ uller Comparing the Complexity of Cut-Elimination Methods . . . . . . . . . . . . . . . . 49 Matthias Baaz, Alexander Leitsch Program Extraction from Gentzen’s Proof of Transﬁnite Induction up to 0 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68 Ulrich Berger Coherent Bicartesian and Sesquicartesian Categories . . . . . . . . . . . . . . . . . . . 78 Kosta Doˇsen, Zoran Petri´c Indexed Induction-Recursion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93 Peter Dybjer, Anton Setzer Modeling Meta-logical Features in a Calculus with Frozen Variables . . . . . . 114 Birgit Elbl Proof Theory and Post-turing Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 130 Lew Gordeew Interpolation for Natural Deduction with Generalized Eliminations . . . . . . . 153 Ralph Matthes Implicit Characterizations of Pspace . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 170 Isabel Oitavem Iterate Logic . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 191 Peter H. Schmitt Constructive Foundations for Featherweight Java . . . . . . . . . . . . . . . . . . . . . . 202 Thomas Studer

Author Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 239

Linear Ramiﬁed Higher Type Recursion and Parallel Complexity Klaus Aehlig1, , Jan Johannsen2, , Helmut Schwichtenberg1, , and Sebastiaan A. Terwijn3,† 1

3

Mathematisches Institut, Ludwig-Maximilians-Universit¨ at M¨ unchen, Theresienstraße 39, 80333 M¨ unchen, Germany {aehlig,schwicht}@rz.mathematik.uni-muenchen.de 2 Institut f¨ ur Informatik, Ludwig-Maximilians-Universit¨ at M¨ unchen Oettingenstraße 67, 80538 M¨ unchen, Germany [email protected] Department of Mathematics and Computer Science, Vrije Universiteit Amsterdam, De Boelelaan 1081a, 1081 HV Amsterdam, The Netherlands [email protected]

Abstract. A typed lambda calculus with recursion in all ﬁnite types is deﬁned such that the ﬁrst order terms exactly characterize the parallel complexity class NC. This is achieved by use of the appropriate forms of recursion (concatenation recursion and logarithmic recursion), a ramiﬁed type structure and imposing of a linearity constraint. Keywords: higher types, recursion, parallel computation, NC, lambda calculus, linear logic, implicit computational complexity

1

Introduction

One of the most prominent complexity classes, other than polynomial time, is the class NC of functions computable in parallel polylogarithmic time with a polynomial amount of hardware. This class has several natural characterizations in terms of circuits, alternating Turing machines, or parallel random access machines as used in this work. It can be argued that NC is the class of eﬃciently parallalizable problems, just as polynomial time is generally considered as the correct formalization of feasible sequential computation. Machine-independent characterizations of computational complexity classes are not only of theoretical, but recently also of increasing practical interest. Besides indicating the robustness and naturalness of the classes in question, they also provide guidance for the development of programming languages [11]. †

Supported by the DFG Graduiertenkolleg “Logik in der Informatik” Supported by the DFG Emmy Noether-Programme under grant No. Jo 291/2-1 The hospitality of the Mittag-Leﬄer Institute in the spring of 2001 is gratefully acknowledged. Supported by a Marie Curie fellowship of the European Union under grant no. ERBFMBI-CT98-3248

R. Kahle, P. Schroeder-Heister, and R. St¨ ark (Eds.): PTCS 2001, LNCS 2183, pp. 1–21, 2001. c Springer-Verlag Berlin Heidelberg 2001

2

K. Aehlig et al.

The earliest such characterizations, starting with Cobham’s function algebra for polynomial time [9], used recursions with explicit bounds on the growth of the deﬁned functions. Function algebra characterizations in this style of parallel complexity classes, among them NC, were given by Clote [8] and Allen [1]. More elegant implicit characterizations, i.e., without any explicitly given bounds, but instead using logical concepts like ramiﬁcation or tiering, have been given for many complexity classes, starting with the work of Bellantoni and Cook [4] and Leivant [14] on polynomial time. In his thesis [2], Bellantoni gives such a characterization of NC using a ramiﬁed variant of Clote’s recursion schemes. A diﬀerent implicit characterization of NC, using tree recursion, was given by Leivant [15], and reﬁned by Bellantoni and Oitavem [6]. Other parallel complexity classes, viz. parallel logarithmic and polylogarithmic time, were given implicit characterizations by Bellantoni [3], Bloch [7] and Leivant and Marion [16]. In order to apply the approach within the functional programming paradigm, one has to consider functions of higher type, and thus extend the function algebras by a typed lambda calculus. To really make use of this feature, it is desirable to allow the deﬁnition of higher type functions by recursion. Higher type recursion was originally considered by G¨ odel [10] for the analysis of logical systems. Systems with recursion in all ﬁnite types characterizing polynomial time were given by Bellantoni et al. [5] and Hofmann [12], based on the ﬁrst-order system of Bellantoni and Cook [4]. We deﬁne an analogous system that characterizes NC while allowing an appropriate form of recursion, viz. logarithmic recursion as used by Clote [8] and Bellantoni [2], in all ﬁnite types. More precisely, our system is a typed lambda calculus which allows two kinds of function types, denoted σ τ and σ → τ , and two sorts of variables of the ground type ι, the complete ones in addition to the usual ones, which are called incomplete for emphasis. A function of type σ → τ can only be applied to complete terms of type σ, i.e., terms containing only complete free variables. It features two recursion operators LR and CR, the latter corresponding to Clote’s [8] concatenation recursion on notation, which can naturally only be applied to ﬁrst-order functions. The former is a form of recursion of logarithmic length characteristic of all function algebra representations of NC, and here can be applied to functions of all linear types, i.e., types only built up using ι and . The function being iterated, as well as the numerical argument being recurred on have to be complete, i.e., the type of LR is σ (ι → σ σ) → ι → σ for linear σ. Our analysis clearly reveals the diﬀerent roles played by the two forms of recursion in characterizing NC: Logarithmic recursion controls the runtime, in that the degree of the polylogarithm that bounds the runtime depends only on the number of occurrences of LR. On the other hand, concatenation recursion is responsible for parallelism; the degree of the polynomial bounding the amount of hardware used depends only on the number of occurrences of CR (and the number of occurences of the constant #.)

Linear Ramiﬁed Higher Type Recursion and Parallel Complexity

3

The crucial restriction in our system, justifying the use of linear logic notation, is a linearity constraint on variables of higher types: all higher type variables in a term must occur at most once. The main new contribution in the analysis of the complexity of the system is a strict separation between the term, i.e., the program, and the numerical context, i.e., its input and data. Whereas the runtime may depend polynomially on the former, it may only depend polylogarithmically on the latter. To make use of this conceptual separation, the algorithm that unfolds recursions computes, given a term and context, a recursion-free term plus a new context. In particular, it does not substitute numerical parameters, as this would immediately lead to linear growth, but only uses them for unfolding; in some cases, including the reduction of CR, it extends the context. This way, the growth of terms in the elimination of recursions is kept under control. In earlier systems that comprised at least polynomial time this strict distinction was not necessary, since the computation time there may depend on the input superlinearly. Note that any reasonable form of computation will depend at least linearly on the size of the program. A direct extension to higher types of the ﬁrst-order system of Bellantoni [2] would have a constant for concatenation recursion of linear type (ι ι) ι ι. This causes problems in our analysis because the amount of hardware required depends exponentially on the number of CR in a term, thus we must not allow duplications of this constant during the unfolding of LR. The only way to avoid this is by giving CR the more restrictive typ (ι → ι) ι → ι. This weaker form of concatenation recursion nevertheless suﬃces to include all of NC, when the set of base functions is slightly extended. Finally, in order to be able to handle numerals in parallel logarithmic time, we use a tree data structure to store numerals during the computation. Whereas trees are used as the principal data structure in other characterizations of parallel complexity classes [15,16], our system works with usual binary numerals, and trees are only used in the implementation.

2

Clote’s Function Algebra for NC

Clote [8] gives a function algebra characterization of NC using two recursion schemes. The class A is deﬁned as the least class of functions that contain the constant 0, projections πjn (x1 , . . . , xn ) = xj , the binary successors s0 , s1 , bit test bit, binary length |x| := log2 (x + 1), and # where x#y = 2|x|·|y| , and is closed under composition and the following two forms of recursion: A function f is deﬁned by concatenation recursion on notation (CRN) from functions g, h0 , h1 if →) = g(− →) f (0, − x x →) = s →)) , →) (f (y, − x x f (si (y), − hi (y,− x

4

K. Aehlig et al.

and f is deﬁned from g, h0 , h1 and r by weak bounded recursion on notation (WBRN) if there is F such that →) = g(− →) F (0, − x x →) = hi (y, − →, F (y, − →)) F (si (y), − x x x − → − → F (y, x ) ≤ r(y, x ) →) = F (|y| , − →) . f (y, − x x

Theorem 1 (Clote [8]). A number-theoretic function f is in A if and only if f is in NC. It is easy to see that the recursion scheme WBRN can be replaced by the following scheme: f is deﬁned from g, h and r by bounded logarithmic recursion if →) = g(− →) f (0, − x x − → →, f (H(y), − →)) f (y, x ) = h(y, − x x →) ≤ r(y, − →) , f (y, − x x where H(n) :=

n

for y > 0

has length about half the length of n. Both forms 2|n|/2 of recursion produce log |y| iterations of the step function. We shall denote the function algebra with bounded logarithmic recursion by A as well.

3

Formal Deﬁnition of the System

We use simple types with two forms of abstraction over a single base type ι, i.e., our types are given by the grammar σ, τ ::= ι | σ τ | σ → τ , and we call the types that are built up from ι and only the linear types. As the intended semantics for our base type are the binary numerals we have the constants 0 of type ι and s0 and s1 of type ι ι. Moreover we add constants len of type ι ι and bit of type ι ι ι for the corresponding base functions of A. The functionality of the base function # is split between two constants, a unary # of type ι → ι to produce growth, and sm of type ι ι ι ι that performs the multiplication of lengths without producing growth. The intended 2 semantics, reﬂected in the conversion rules below, is #n = 2|n| and sm(w, a, b) = 2|a|·|b| mod 2|w| . In order to embed A into the system, we need two more constants drop of type ι ι ι and half of type ι ι, intended to denote the functions n drop(n, m) = 2|m| and H, respectively.

Linear Ramiﬁed Higher Type Recursion and Parallel Complexity

5

We allow case-distinction for arbitrary types, so we have a constant dσ of type ι σ σ σ for every type σ. Recursion is added to the system via the constant LR and parallelism via the constant CR. Their types are CR LRσ

: :

(ι → ι) ι → ι σ (ι → σ σ) → ι → σ

for σ linear

Terms are built from variables and constants via abstraction and typed application. We have incomplete variables of every type, denoted by x, y, . . . and complete variables of ground type, denoted by x, y, . . . . All our variables and terms have a ﬁxed type and we add type superscripts to emphasize the type: xσ , xι , tσ . Corresponding to the two kinds of function types, there are two forms of abstraction στ

(λxσ .tτ )

and

ι→τ

(λxι .tτ )

and two forms of application

tστ sσ

τ

and

τ

(tσ→τ sσ ) ,

where in the last case we require s to be complete, and a term is called complete if all its free variables are. It should be noted that, although we cannot form terms of type σ → τ with σ = ι directly via abstraction, it is still important to have that type in order to express, for example, that the ﬁrst argument of LR must not contain free incomplete variables. In the following we omit the type subscripts at the constants dσ and LRσ if the type is obvious or irrelevant. Moreover we identify α-equal terms. As usual application associates to the left. A binary numeral is either 0, or of the form si1 (. . . (sik (s1 0))). We abbreviate the binary numeral (s1 0) by 1. The semantics of ι as binary numerals (rather than binary words) is given by the conversion rule s0 0 → 0. In the following deﬁnitions we identify binary numerals with the natural number they represent. The base functions get their usual semantics, i.e., we add conversion rules len n → |n|, drop n m → drop(n, m), half n → H(n), bit n i → 2ni mod 2, sm w m n → sm(w, m, n). Moreover, we add the conversion rules dσ 0 dσ (si n)

→ →

λxσ y σ . x λxσ0 xσ1 . xi

#n CR h 0 CR h (si n) LR g h 0 LR g h n

→ → → → →

s0 |n| 1 0 d(ιι) (h (si n)) s0 s1 (CR h n) g h n (LR g h (half n))

2

6

K. Aehlig et al.

Here we always assumed that n, m and si n are binary numerals, and in particular that the latter does not reduce to 0. In the last rule, n has to be a binary numeral diﬀerent from 0. As usual the reduction relation is the closure of → under all term forming operations and equivalence is the symmetric, reﬂexive, transitive closure of the reduction relation. As all reduction rules are correct with respect to the intended semantics and obviously all closed normal terms of type ι are numerals, closed terms t of type ι have a unique normal form that we denote by tnf . As usual, lists of notations for terms/numbers/ . . . that only diﬀer in successive indices are denoted by leaving out the indices and putting an arrow over the notation. It is usually obvious where to add the missing indices. If not we add a dot wherever an index is left out. Lists are inserted into formulae −−→ − → “in the natural way”, e.g., hm· = hm1 , . . . , hmk and x t = ((x t1 ) . . . tk ) and −→ |g| + |s| = |g| + |s1 | + . . . + |sk |. Moreover, by abuse of notation, we denote lists →. consisting of maybe both, complete and incomplete variables also by − x As already mentioned, we are not interested in all terms of the system, but only in those fulﬁlling a certain linearity condition. Deﬁnition 1. A term t is called linear, if every variable of higher type in t occurs at most once. Since we allow that the variable x does not occur in λx.t, our linear terms should correctly be called aﬃne, but we keep the more familiar term linear.

4

Completeness

→ →) if for every − →, Deﬁnition 2. A term t : − ι → ι denotes the function f (− x n → reduces to the numeral f (− →). t− n n We will sometimes identify a term with the function it denotes. In order to prove that our term system can denote all functions in NC, we ﬁrst have to deﬁne some auxiliary terms. We deﬁne ones := CR(λx.1), then we have that ones n = 2|n| − 1, i.e., a numeral of the same length as n consisting of ones only. We use this to deﬁne ≤ := λy b . bit (ones y) (len b) , so that ≤ m n is the characteristic function of |m| ≤ |n|. We will write ≤ inﬁx in the following. It is used to deﬁne max := λa b . d (a ≤ b) b a computing the longer of two binary numerals. Next we deﬁne rev := λx.CR(λi.bit x i), so that rev m n returns the |n| least signiﬁcant bits of m reversed. Finally we deﬁne the binary predecessor as p := λx.drop x 1.

Linear Ramiﬁed Higher Type Recursion and Parallel Complexity

7

→) in A, there is a closed linear term tf of Theorem 2. For every function f (− x − → type ι → ι that denotes f . Proof. The proof follows the lines of Bellantoni’s [2] completeness proof for his two-sorted function algebra for NC. We will use the following fact: for every function f ∈ A there is a polynomial → →, |f (− →)| ≤ qf (− qf such that for all − n n |n| ). To prove the theorem, we will prove the following stronger claim: → →) ∈ A, there is a closed linear term tf of type ι → − ι ι For every f (− x − → − → →) for n and a polynomial pf such that for every n , tf w n reduces to f (− −→ all w with |w| ≥ pf (|n| ). The claim implies the theorem, since by use of the constant # and the term → → →, |wf − →| ≥ pf (− max , we can deﬁne terms wf : − ι → ι such that for all − n |n| ). n We prove the claim by induction on the deﬁnition of f in the function algebra A with bounded logarithmic recursion. If f is any of the base functions 0, si , |.| , bit, then we let tf := λw.c where c is →.xj . x the corresponding constant of our system, and for f = πjn we let tf := λw − In these cases we can set pf = 0, and the claim obviously holds. If f is #, then we set tf := λw . sm w. It holds that tf w a b = a#b as long as |a| · |b| < |w|, so we set pf (x, y) = x · y + 1. −→ →) = h(−− → If f is deﬁned by composition, f (− x g(− x ) ), then by induction we have −−−− −→ − → − → →.th w− → terms th , tg and polynomials ph , pg . We deﬁne tf := λw− x (tg w− x ) and − − − − → − − − − → →) ) + pg (− →) . The claim follows easily from the induction →) := ph (qg (− x x x pf (− hypothesis. Now let f be deﬁned by CRN from g, h0 , h1 , and let tg , thi be given by induction. First we deﬁne a function h that combines the two step functions into one, by h := λw y . d y (th0 w (p y)) (th1 w (p y)) →) x then we use this to deﬁne a function f that computes an end-segment of f (y, − reversed, using CR, by → → z . d (z ≤ y) h w (drop y (p z)) − x aux := λw y − x →) (|z| − |y| − 1) bit (tg w − x → . CR (aux w y − →) , f := λw y − x x where |z| − |y| − 1 is computed as len (drop z (s1 y)). Finally, the computed value is reversed, and tf is deﬁned by → . rev (f w y − → w) w . x x tf := λw y −

8

K. Aehlig et al.

In order for this to work, w has to be large enough for g and the hi to be computed correctly by the inductive hypothesis, thus pf needs to maximize pg and the phi . Also, w has to be long enough for the concatenation recursion in the →), so |w| has to be larger deﬁnition of f to actually compute all bits of f (y, − x − → than |y| + |g( x )|. All this is guaranteed if we set →) := pg (− →) + pf (y, − x x

→) + y + qg (− →) + 1 . x phi (y, − x

i=1,2

Finally, let f be deﬁned by bounded logarithmic recursion from g, h and r, →) = g(− →) f (0, − x x →) = h(y, − →, f (H(y), − →)) f (y, − x x x →) ≤ r(y, − →) , f (y, − x x

for y > 0

and let tg and th be given by induction. In order to deﬁne tf , we cannot use logarithmic recursion on y since y is incomplete. Instead we simulate the recursion on y by a recursion on a complete argument. We ﬁrst deﬁne a function Y that yields the values H (k) (y) that are needed in the recursion as S := λu v ιι y . d (u ≤ z) y (half (v y)) Y := λz w . LRιι (λy.y) S w . We now use this function to deﬁne a term f computing f by recursion on a complete argument z by − →ι

T := λu v ι ι

→ . d ((Y u w y) = 0) (tg w y − →) y− x x → (v y − →) th w (Y u w y) − x x

− → → f := λw z . LRι− ι ι (λ y x . 0) T z where the test x = 0 is implemented as d (bit (s0 x) (len x)) 1 0. Finally, tf is deﬁned by identifying the complete arguments in f : tf := λw . f w w To show the correctness of this deﬁnition, deﬁne →) := 2y + ph (y, − →, qr (y, − →)) + pg (− →) pf (y, − x x x x → → and w with |w| ≥ pf (|y| , − |x| ). and ﬁx y, − x Note that the only values of z for which the function Y is ever invoked during the computation are H (k) (w) for 0 ≤ k ≤ ||y||, and that for these values of z,

Linear Ramiﬁed Higher Type Recursion and Parallel Complexity

9

Y (z, w, y) varies over the values H (k) (y). By a downward induction on k we show that for these values of z, →) = f (Y (z, w, y), − →) . (f (w, z, y, − x x This implies the claim for tf , since Y (w, w, y) = y. The induction basis occurs for k = ||y||, where V (z, w, y) = 0. Since |w| ≥ 2 |y|, we have z > 0, thus the recursive step in the deﬁnition of f is used, and the ﬁrst branch of the case distinction is chosen. Therefore the equality follows from the fact that w is large enough for tg to compute g correctly. In the inductive step, we use the fact that Y (H(z), w, y) = H(Y (z, w, y)), and that w is large enough for th to compute h correctly. Since for z = H (k−1) (w) we have Y (z, w, y) > 0, we get →) = th (w, Y (z, w, y), − →, f (w, H(z), y, − →) f (w, z, y, − x x x →, f (Y (H(z), w, y), − →) x x = th (w, Y (z, w, y), − →, f (H(Y (z, w, y)), − →) = th (w, Y (z, w, y), − x x − → − → = h(Y (z, w, y), x , f (H(Y (z, w, y)), x )) →) = f (Y (z, w, y), − x

where the second equality holds by the induction hypothesis. This completes the proof of the claim and the theorem.

5

Soundness

Deﬁnition 3. The length |t| of a term t is inductively deﬁned as follows: For a variable x, |x| = 1, and for any constant c other than d, |c| = 1, whereas |d| = 3. For complex terms we have the usual clauses |r s| = |r| + |s| and |λx.r| = |r| + 1. The length of the constant d is motivated by the desire to decrease the length of a term in the reduction of a d-redex. Note that due to our identiﬁcation of natural numbers with binary numerals, the notation |n| is ambiguous now. Nevertheless, in the following we will only use |n| as the term length deﬁned above which for numerals n diﬀers from the binary length only by one. → → of numerals, deﬁne |− →| := max(− Deﬁnition 4. For a list − n n |n| ). Deﬁnition 5. A context is a list of pairs (x, n) of variables (complete or incom→ is a list plete) of type ι and numerals, where all the variables are distinct. If − x − → of distinct variables of type ι and n a list of numerals of the same length, then −→ →; − → the context −− we denote by − x n (x, n) . Deﬁnition 6. For every symbol c of our language and term t, )c (t) denotes the number of occurrences of c in t. For obvious aesthetic reasons we abbreviate )# (t) by #(t). Deﬁnition 7. A term t is called simple if t contains none of the constants #, CR or LR.

10

K. Aehlig et al.

Bounding the Size of Numerals →; − → a context, such Lemma 1. Let t be a simple, linear term of type ι and − x n ∗ − → − → →]nf we have that all free variables in t are among x . Then for t := t[ x := − n →|. |t∗ | ≤ |t| + |− n Proof. By induction on |t|. We distinguish cases according to the form of t. → → Case 1: t is x − r for a variable x. Since x must be of type ι, − r must be ∗ − → empty, and t is just one of the numerals in n . → Case 2: t is c − r for a constant c. Here we have four subcases, depending on the constant c. → Case 2a: c is 0, so − r is empty and t is already normal. → := − →]nf , Case 2b: c is si , so t is c r for a term r of type ι. Let r∗ := r[− x n ∗ →|, and therefore we get by the induction hypothesis we have |r | ≤ |r| + |− n →| . |t∗ | ≤ |r∗ | + 1 ≤ |t| + |− n → Case 2c: c is one of the constants len, half, drop, bit or sm, so t is c r − s for → → := − →]nf , by the induction hypothesis we terms r, − s of type ι. Let r∗ := r[− x n →|, and therefore we get |t∗ | ≤ |r∗ | ≤ |t| + |− →| . have |r∗ | ≤ |r| + |− n n − → Case 2d: c is dσ , so t is dσ s u0 u1 v , where s is of type ι and ui are of type σ. → := − →], t reduces to the shorter Depending on the last bit i of the value of s[− x n → term t = ui − v , to which we can apply the induction hypothesis obtaining the →| < |t| + |− →|. n n normal form t∗ with |t∗ | ≤ |t | + |− − → Case 3: t is (λx.r) s s . Here we have two subcases, depending on the number of occurrences of x in r. → Case 3a: x occurs at most once, then the term t := r[x := s] − s is smaller than t, and we can apply the induction hypothesis to t . Case 3b: x occurs more than once, and thus is of type ι. Then s is of type ι, so → := − →]nf with we ﬁrst apply the induction hypothesis to s, obtaining s∗ := s[− x n →|. Now we let t := r − → |s∗ | ≤ |s| + |− n s , and we apply the induction hypothesis ∗ − → − → to t and the context x , y; n , s , so we get →, s∗ | ≤ |t | + |s| + |− →| . |t∗ | ≤ |t | + |− n n The last case, where t is λx.r, cannot occur because of the type of t.

Data Structure We represent terms as parse trees, fulﬁlling the obvious typing constraints. The number of edges leaving a particular node is called the out-degree of this node. There is a distinguished node with in-degree 0, called the root. Each node is stored in a record consisting of an entry cont indicating its kind, plus some pointers to its children. We allow the following kinds of nodes with the given restrictions: – Variable nodes representing a variable x. Variable nodes have out-degree 0. Every variable has a unique name and an associated register R[x].

Linear Ramiﬁed Higher Type Recursion and Parallel Complexity

11

– Abstraction nodes λx representing the binding of the variable x. Abstraction nodes have out-degree one, and we denote the pointer to its child by succ. – For each constant c, there are nodes representing the constant c. These nodes have out-degree 0. – Application nodes @ representing the application of two terms. The obvious typing constraints have to be fulﬁlled. We denote the pointers to the two children of an application node by left and right. – Auxiliary nodes κi representing the composition of type one. These nodes are labeled with a natural number i, and each of those nodes has out-degree either 2 or 3. They will be used to form 2/3-trees (as e.g. described by Knuth [13]) representing numerals during the computation. We require that any node reachable from a κ· -node is either a κ· node as well or one of the constants s0 or s1 . – Auxiliary nodes κ representing the identiﬁcation of type-one-terms with numerals (via “applying” them to 0). The out-degree of such a node, which is also called a “numeral node”, either is zero, in which case the node represents the term 0, or the out-degree is one and the edge starting from this node either points to one of the constants s0 or s1 or to a κ· node. – Finally, there are so-called dummy nodes of out-degree 1. The pointer to the child of a dummy node is again denoted by succ. Dummy nodes serve to pass on pointers: a node that becomes superﬂuous during reduction is made into a dummy node, and any pointer to it will be regarded as if it pointed to its child. A tree is called a numeral if the root is a numeral node, all leaves have the same distance to the root and the label i of every κi node is the number of leaves reachable from that node. By standard operations on 2/3-trees it is possible in sequential logarithmic time to – split a numeral at a given position i. – ﬁnd out the i’th bit of the numeral. – concatenate two numerals. So using κ and κ· nodes is just a way of implementing “nodes” labeled with a numeral allowing all the standard operations on numerals in logarithmic time. Note that the length of the label i (coded in binary) of a κi node is bounded by the logarithm of the number of nodes. Normalization Algorithms and Their Complexity →; − → a context such that Lemma 2. Let t be a simple, linear term of type ι and − x n − → → := − →] all free variables in t are among the x . Then the normal form of t[− x n − → − → can be computed in time O(|t| · log | n |) by O(|t| · | n |) processors. Proof. We start one processor for each of the nodes of the parse-tree of t, with a pointer to this node in its local register. The registers associated to the variables − → in the context contain pointers to the respective numerals − →, and the registers x n associated to all other variables are initialized with a NULL pointer.

12

K. Aehlig et al.

The program operates in rounds, where the next round starts once all active processors have completed the current round. The only processors that will ever do something are those at the application or variable nodes. Thus all processors where cont ∈ / {@, x, d} can halt immediately. Processors at d nodes do not halt because they will be converted to variable nodes in the course of the reduction. The action of a processor at an application node in one round depends on the type of its sons. If the right son is a dummy node, i.e., right.cont = , then this dummy is eliminated by setting right := right.succ. Otherwise, the action depends on the type of the left son. – If left.cont = , then eliminate this dummy by setting left := left.succ. – If left.cont = λx, then this β-redex is partially reduced by copying the argument right into the register R[x] associated to the variable x. The substitution part of the β-reduction is then performed by the processors at variable nodes. Afterwards, replace the @ and λx nodes by dummies by setting cont := , left.cont := and succ := left. – If left.cont ∈ {si , len, half} and the right son is a numeral, right.cont = κ , then replace the current node by a dummy, and let succ point to a numeral representing the result. In the case of si and half, this can be implemented →|). by 2/3-tree operations using sequential time O(log |− n In the case of len, the result is equal to the number i of leaves of the numeral argument. This value is read oﬀ the topmost κi node, and a numeral of that →|), this can also be value is produced. Since i is a number of length O(log |− n →|). done in sequential time O(log |− n – If left.cont = @, left.left.cont ∈ {drop, bit} and right and left.right both point to numerals, then again replace the current node by a dummy, and let succ point to a numeral representing the result, which again can be →|). computed by 2/3-tree operations in time O(log |− n – If left.cont = left.left.cont = @, left.left.left.cont = sm and all of right, left.right and left.left.right point to numerals, then again the current node is replaced by a dummy with succ pointing to the result. To compute the result, the lengths i and j are read oﬀ the second and third →|) bit numbers, this can argument, and multiplied. As i and j are O(log |− n 3 − − → →|) many processors. be done in parallel time O(log log | n |) by O(log | n The product i · j is compared to the length of the ﬁrst argument; let the maximum of both be k. Now the result is a numeral consisting of a one followed by k zeroes, which can be produced in parallel time log2 k by O(k) many processors using the square-and-multiply method, which suﬃces since →|). k ≤ O(log |− n – Finally, if left.cont = d and right.cont = κ , then extract the last bit b of the numeral at right, and create two new variables x0 and x1 . Then reduce the d-redex by replacing the current node and the right son by abstraction nodes, and the left son by a variable node, i.e., setting cont := λx0 , right.cont := λx1 , succ.right, succ.succ := left and left.cont := xb . A processor with cont = x only becomes active when R[x] = NULL, and what it does then depends on the type of x.

Linear Ramiﬁed Higher Type Recursion and Parallel Complexity

13

If x is not of ground type, then the variable x occurs only in this place, so the substitution can be safely performed by setting cont := and succ := R[x]. If x is of type ι, the processor waits until the content of register R[x] has been normalized, i.e., it acts only if R[x].cont = κ . In this case, it replaces the variable node by a dummy, and lets succ point to a newly formed copy of the →|) by |− →| numeral in R[x]. This copy can be produced in parallel time O(log |− n n − → processors, since the depth of any numeral is bounded by log | n |. Concerning correctness, note that the tree structure is preserved, since numerals being substituted for type ι variables are explicitly copied, and variables of higher type occur at most once. Obviously, no redex is left when the program halts. For the time bound, observe that every processor performs at most one proper reduction plus possibly some dummy reductions. Every dummy reduction makes one dummy node unreachable, so the number of dummy reductions is bounded by the number of dummy nodes generated. Every dummy used to be a proper node, and the number of nodes is at most 2 |t|, so this number is bounded by 2 |t|. Thus at most 4 |t| reductions are performed, and the program ends after at →|) most that many rounds. As argued above, every round takes at most O(log |− n − → operations with O(| n |) many additional processors.

The next lemma is the key to show that all terms can be normalized in NC: it shows how to eliminate the constants #, LR and CR. As mentioned in the introduction, we have to distinguish between the program, i.e., the term we wish to normalize, and its input, given as a context. The runtime and length of the output term may depend polynomially on the former, but only polylogarithmically on the latter. Since an ordinary O(·)-analysis is too coarse for the inductive argument, we need a more reﬁned asymptotic analysis. Therefore we introduce the following notation: f (n) g(n) : ⇐⇒ f (n) ≤ (1 + o(1))g(n) , or equivalently lim supn→∞

f (n) g(n)

≤ 1.

→ a context with all →; − n x Lemma 3. Let t be a linear term of linear type and − − → − → →; − →) free variables of t[ x := n ] incomplete. Then there are a term simp(t, − x n − → − → − → − → − → − → and a context y ; m such that simp(t, x ; n )[ y := m ] is simple and equivalent → := − →], and which can be computed in time to t[− x n →|) 2LR (t) · |t| · (2#(t) · log |− →|)LR (t)+2 T (|− n n by

→|)2#(t) (LR (t)+1) →|) |t| · |− →|2#(t) (CR (t)+2) · (log |− n P (|− n n

processors, such that (t) →; − →)| |t| · 2#(t) · log |− →| LR →| |− →|2#(t) . |simp(t, − x n n and |− m n

14

K. Aehlig et al.

The proof is somewhat lengthy, so we sketch it ﬁrst: We start by describing the algorithm. It searches for the head-redex and reduces it in the obvious way (and then continues in the same way until the term is normal): in the case of a ground-type β-redex enlarge the context, in the case of a higher type β-redex reduce it in the term; in the case of LR the step term has to be unfolded only logarithmically many times, so we can just form a new term, whereas in the case of CR we have to use parallelism. However, in this case the result of every processor is just a single bit, so the results can be collected eﬃciently and returned to the context (whereas in the case of LR the result is a term of higher type). Note the crucial interplay between the length of the term, the size of the context, the running time and the number of processors needed; therefore we have to provide all four bounds simultaneously. After the description of the algorithm, a long and tedious (but elementary) calculation follows showing that all bounds indeed hold in every case. The structure of the proof is always the same: in the interesting cases a numerical argument has to be evaluated in order to be able to reduce the redex (i.e., the numeral we recurse on, or the numeral to be put in the context in the case of a ground type β-redex). Then the induction hypothesis yields the size of this numeral and also the amount of time and processors needed. Then calculate the length of the unfolded term. The induction hypothesis for this term yields the amount of time and processors needed for the ﬁnal computation, and also the bounds for the ﬁnal output. Summing up all the times (calculation of the numeral, unfolding, ﬁnal computation) one veriﬁes that the time bound holds as well. Proof (of lemma 3). By induction on )LR (t), with a side-induction on |t| show that the following algorithm does it: By pattern matching, determine in time O(|t|) the form of t, and branch according to the form. →; − → – If t is a variable or one of the constants 0 or d, then return t and leave − x n unchanged. → – If t is c − s , where c is one of the constants si , drop, bit, len or sm then − → − → ∗ → −→ recursively simplify − s , giving s∗ and contexts − y→ j ; mj , and return c s − → − → − → − → and y ; m . → →. Compute the numeral → y ;− m – If t is d r − s , then simplify r giving r and − nf ∗ − ∗ → − → r := r [ y := m ] , and reduce the redex d r , giving t , and recursively → →; − →. simplify t − s with context − x n → →. Compute the numeral r∗ := y ;− m – If t is # r then simplify r giving r and − ∗ 2 nf − → − → r [ y := m ] , and return a new variable y and the context y ; 2|r | . → →, and compute the numeral – If t is CR h r, then simplify r giving r and − y ;− m nf ∗ − → − → r := r [ y := m ] . Spawn |r∗ | many processors, one for each leaf of r∗ , by moving along the ∗ ∗ tree structure r . The processor at bit i of r simpliﬁes h z in the context ∗ of i − → − → x , z; n , r /2 (with z a new complete variable), giving a term hi and nf ∗ → −→ context y− i ; mi , then he computes hi := hi [yi := mi ] , retaining only the lowest order bit bi .

Linear Ramiﬁed Higher Type Recursion and Parallel Complexity

15

− → The bits b are collected into a 2/3-tree representation of a numeral m, which is output in the form of a new variable z and the context z; m. −− → → – t is LR g h m − s then simplify m, giving m and −→ xm ; n m . Normalize m in the i ∗ − → −→ − → − − → context x , xm ; n , nm , giving m . Form k numerals mi = half (m∗ ) and − → −−−→ sequentially simplify h m· , giving h . (Of course, more precisely simplify h x for a new variable x in the context extended by x; mi .) Then form the term → t := h 0 (h 1 . . . (h k g)) − s and simplify it. – If t is of the form λx.r then recursively simplify r. → – If t is of the form (λx.r) s − s and x occurs at most once in r then recursively − → simplify r[x := s] s . → – If t is of the form (λx.r) s − s and x occurs several times in r, then simplify → →. Normalize s in this context giving the s giving s and a context − y ;− m ∗ − → →, x; − →, s∗ . numeral s . Then simplify r s in the context − x n → For correctness, note that in the case d r − s simplifying r takes time (r)+2 →| LR n 2LR (r) · |r| · 2#(r) · log |− and uses

→|)2#(r) (LR (r)+1) →|2#(r) (CR (r)+2) (log |− n |r| · |− n →|LR (r) and many processors. For the output we have |r | |r| · 2#(r) · log |− n →| |− →|2#(r) . Hence the time used to normalize r (using the algorithm of |− m n →|), which is (order of) lemma 2) is O(|r | · log |− m (r)+1 →| LR |r| · 2LR (r) · log |− n →|) ≤ |r| · |− →|2#(r) +1 . Finally, and the number of processors needed is O(|r | · |− m n → to simplify t − s we need time − → − → → s )+2 → →|)LR (− 2LR ( s ) · (|− s | + 3) · (2#( s ) · log |− n

and the number of processors is − →)

→ →|2#( s (|− s | + 3) |− n

→ s )+2) (CR (−

→)2 (log − n

→ #(− s )

→ (LR (− s )+1)

Summing up gives an overall time that is (t)+2 → →| LR s | + 3) · 2#(t) · log |− n 2LR (t) · (|r| + |− which is a correct bound since |d| = 3. Maximizing gives that the overall number of processors is →| |t| · |− n

2#(t) (CR (t)+2)

→|)2 (log |− n

#(t)

(LR (t)+1)

16

K. Aehlig et al.

The length of the output term is − → → s ) → →|LR (− (|− s | + 3) · 2#( s ) · log |− n − →

→|2#( s ) , which suﬃces. n and the size of the output context is |− In the case # r we obtain the same bounds for simpliﬁcation and normalization of r as in the previous case. For r∗ we get →|) |− →|2#(r) m n |r∗ | = O(|r | + |− Computing the output now takes time 2 →| n log |r∗ | = 2#(r)+1 · log |−

and

2 →|2#(r)+1 n |r∗ | |−

many processors. Thus the overall time is (r)+2 →| LR 2LR (r) · |r| · 2#(r)+1 · log |− n and the number of processors is →|)2#(r) (LR (r)+1) . →|2#(r)+1 (CR (r)+2) · (log |− n |r| · |− n The length of the output term is 1, and the size of the output context is bounded 2 →|2#(r)+1 , which implies the claim. by |r∗ | + 1 |− n In the case CR h r note that the arguments h : ι → ι and r : ι both have to be present, since t has to be of linear type (and CR : (ι → ι) ι → ι). We obtain the same bounds for simpliﬁcation and normalization of r and the length of the numeral r∗ as in the previous case. Spawning the parallel processors and →|. The main collecting the result in the end each needs time log |r∗ | = 2#(r) · |− n #(r) 2 →| many processors that do the simpliﬁcation and work is done by the |− n normalization of the step terms. Each of them takes time

(h)+2 →, r∗ | LR 2LR (h) · (|h| + 1) · 2#(h) · log |− n (h)+2 →| LR 2LR (h) · (|h| + 1) · 2#(h)+#(r) · log |− n and a number of sub-processors satisfying →, r∗ |)2#(h) (LR (h)+1) →, r∗ |2#(h) (CR (h)+2) · (log |− n (|h| + 1) · |− n →| (|h| + 1) · |− n

2#(h)+#(r) (CR (h)+2)

→|)2 · (2#(r) log |− n

#(h)

(LR (h)+1)

Linear Ramiﬁed Higher Type Recursion and Parallel Complexity

17

→|2#(h)+#(r) (CR (h)+2) · (log |− →|)2#(h)+#(r) (LR (h)+1) (|h| + 1) · |− n n −→ to compute hi and − y→ i ; mi with (h) →, r∗ | LR |hi | (|h| + 1) · 2#(h) · log |− n (h) →| LR (|h| + 1) · 2#(h)+#(r) · log |− n and

− → ∗ 2#(h) |− →|2#(h)+#(r) |− m→ n i | |n , r |

Now the normal form h∗i is computed in time (h)+1 #(h)+#(r) −→ →| LR · log |− n O(|hi | · log |m i |) (|h| + 1) · 2 by − → 2#(h)+#(r) +1 · (log |− →|)2#(h)+#(r) (LR (h)+1) m→ n O(|hi | · |− i |) (|h| + 1) | n | many sub-processors. Summing up the times yields that the overall time is (r)+2 →| LR 2LR (r) · |r| · 2#(r) · log |− n (h)+2 →| LR + 2LR (h) · (|h| + 1) · 2#(h)+#(r) · log |− n (t)+2 →| LR 2LR (t) · (|r| + |h| + 1) · 2#(t) · log |− n The number of sub-processors used by each of the |r∗ | processes is →|2#(h)+#(r) (CR (h)+2) · (log |− →|)2#(h)+#(r) (LR (h)+1) (|h| + 1) · |− n n →|2#(r) on the number of processes and multiplying this by the upper bound |− n yields that the bound for the total number of processor holds. The output term is →|2#(r) . of length 1, and the length of the output context is bounded by |r∗ | |− n → In the case LR g h m − s note that, as t has linear type, all the arguments up to and including the m have to be present. Moreover, h is in a complete position, so it cannot contain incomplete free variables, therefore neither can do any of − → the h ; so t really is linear. Due to the typing restrictions of the LR the step −−→ functions hm· have linear type. So in all cases we’re entitled to recursively call the algorithm and to apply the induction hypothesis. For calculating m∗ we have →|. n the same bounds as in the previous cases. We have k ∼ log |m∗ | 2#(m) log |− − → The time needed for calculating the h is →, m∗ |)LR (h)+2 n ≤ k2LR (h) (|h| + 1)(2#(h) log |−

18

K. Aehlig et al.

→|)LR (h)+3 2LR (h) (|h| + 1)(2#(h)+#(m) log |− n

−

→

For the length h we have

−

→ →, m∗ |LR (h) n

h (|h| + 1) 2#(h) · log |− →|LR (h) (|h| + 1) 2#(h)+#(m) log |− n − → → and the length of the numerals − n in the contexts output by the computation #(h) − → ∗ 2 − → →|2#(m) )2#(h) = |− →|2#(m)+#(h) . For (|− n n of the h is bounded by | n , m | the length of t we have

− −→

→

|t | ≤ k h + |g| + |s| −→ →|LR (h)+1 n (|h| + |g| + |s| + 1) 2#(h)+#(m) log |− So the ﬁnal computation takes time

− → LR (t )+2

→ − → n ,n 2LR (t ) |t | (2#(t ) log −

) −−−−→ −→ →|)LR (h)+1 2LR (g)+LR (s) (|h| + |g| + |s| + 1)(2#(h)+#(m) log |− n −−−−→

−−−→

→|)LR (g)+LR (s) +2 · (2#(g)+#(s) · 2#(m)+#(h) log |− n −−−−→ −−−−→ −→ →|)LR (h)+1+LR (g)+LR (s) +2 . 2LR (g)+LR (s) (|h| + |g| + |s| + 1)(2#(t) log |− n So summing up all the times one veriﬁes that the time bound holds. The number of processors needed in the ﬁnal computation is

#(t ) (CR (t )+2)

− → 2 → 2#(t ) (LR (t )+1)

−

→ − → − → → |t | · n , n

(log − n ,− n

) (h)+1 −→ →| LR (|h| + |g| + |s| + 1) 2#(h)+#(m) log |− n

→|2#(m)+#(h) · |− n

2#(t ) (CR (t )+2)

2#(t ) (LR (t )+1) →| n · 2#(m)+#(h) log |− −→ →|2#(m)+#(h)+#(t ) (CR (t )+2) (|h| + |g| + |s| + 1) · |− n (h)+1+2#(t ) (LR (t )+1) →| LR · 2#(m)+#(h) log |− n

2#(t ) (LR (h)+LR (t )+2) →|2#(t) (CR (t)+2) · 2#(m)+#(h) log |− →| |t| · |− n n

→|2#(t) (CR (t)+2) · (log |− →|)2#(m)+#(h)+#(t ) (LR (h)+LR (t )+2) |t| · |− n n

#(t ) − → 2

− →|2#(m)+#(h)+#(t ) . → − → The context ﬁnally output is bounded by n , n

|− n The length of the ﬁnal output is bounded by

− → LR (t )

→ − → n ,n |t | · (2#(t ) log −

)

Linear Ramiﬁed Higher Type Recursion and Parallel Complexity

19

−→ →|)LR (h)+1 n (|h| + |g| + |s| + 1)(2#(h)+#(m) log |− →|)LR (t ) · (2#(t )+#(m)+#(h) log |− n −→ →|)LR (t )+LR (h)+1 (|h| + |g| + |s| + 1)(2#(t )+#(m)+#(h) log |− n So all bounds hold in this case. In the case λx.r note that due to the fact that t has linear type x has to be incomplete, so we’re entitled to use the induction hypothesis. → In the case (λx.r) s − s with several occurrences of x in r note that due to the fact that t is linear, x has to be of ground type (since higher type variables are only allowed to occur once). The time needed to calculate s is bounded by →|)LR (s)+2 2LR (s) |s| (2#(s) log |− n and the number of processors is not too high. For the length of s we have →|)LR (s) |s | |s| · (2#(s) log |− n − →| |− →|2#(s) . So the time for calculating s∗ is bounded by and |m n →, − →| |s| · (2#(s) log |− →|)LR (s)+1 |s | log |− n m n For the length of the numeral s∗ we have →, − →| |− →|2#(s) |s∗ | ≤ |s | + |− n m n So the last computation takes time (r− → s )+2 − → − → → →| LR s | 2#(r s )+#(s) log |− n . 2LR (r s ) · |r− Summing up, the time bound holds. The number of processors needed for the last computation is bounded by s ) s ) → 2#(r−→ 2#(r−→ → (CR (r − s )+2) (LR (r − s )+1) →| → →|2#(s) 2#(s) log |− n |r− s | · |− n − →)

→|2#(s)+#(r s |t| · |− n

→ (CR (r − s )+2)

− →)

→|)2#(s)+#(r s (log |− n − →

→ (LR (r − s )+1) − →

→, s∗ |2#(r s ) |− →|2#(s)+#(r s ) . The context ﬁnally output is bounded by |− n n In all other cases the bounds trivially hold.

We conclude that a term of linear type can be simpliﬁed by an NC algorithm, where the degree of the runtime bound only depends on the number of occurrences of LR, and the degree of the hardware bound only depends on the number of occurrences of # and CR. More precisely, we have the following corollary.

20

K. Aehlig et al.

→) and the new context − → → in the above →; − n y ;− m x Corollary 1. The term simp(t, − lemma can be computed in time →|) ≤ O((log |− →|)LR (t)+2 ) T (|− n n by a number of processors satisfying →|) ≤ O(|− →|2#(t) (CR (t)+3) ) . P (|− n n → Theorem 3. Let t be a linear term of type − ι → ι. Then the function denoted by t is in NC. → → be an input, given as 2/3-tree representations of numerals, and − Proof. Let − n x − → − → − → complete variables of type ι. Using Lemma 3, we compute t := simp(t x , x ; n ) →|)O(1) and |− →| ≤ |− →|O(1) in time → → with |t | ≤ (log |− n m n and a new context − y ;− m O(1) →| →|)O(1) by |− n many processors. (log |− n → →]nf in time y := − m Then using Lemma 2 we compute the normal form t [− O(1) O(1) − − → − → → − → by O(|t | |m |) = | n | many processors. O(|t | · log |m |) = (log | n |) Hence the function denoted by t is computable in polylogarithmic time by polynomially many processors, and thus is in NC.

From Theorems 2 and 3 we immediately get our main result: Corollary 2. A number-theoretic function f is in NC if and only if it is denoted by a linear term of our system.

References 1. B. Allen. Arithmetizing uniform NC. Annals of Pure and Applied Logic, 53(1):1–50, 1991. 2. S. Bellantoni. Predicative Recursion and Computational Complexity. PhD thesis, University of Toronto, 1992. 3. S. Bellantoni. Characterizing parallel time by type 2 recursions with polynomial output length. In D. Leivant, editor, Logic and Computational Complexity, pages 253–268. Springer LNCS 960, 1995. 4. S. Bellantoni and S. Cook. A new recursion-theoretic characterization of the polytime functions. Computational Complexity, 2:97–110, 1992. 5. S. Bellantoni, K.-H. Niggl, and H. Schwichtenberg. Higher type recursion, ramiﬁcation and polynomial time. Annals of Pure and Applied Logic, 104:17–30, 2000. 6. S. Bellantoni and I. Oitavem. Separating NC along the δ axis. Submitted, 2001. 7. S. Bloch. Function-algebraic characterizations of log and polylog parallel time. Computational Complexity, 4:175–205, 1994. 8. P. Clote. Sequential, machine independent characterizations of the parallel complexity classes ALogT IM E, AC k , N C k and N C. In S. Buss and P. Scott, editors, Feasible Mathematics, pages 49–69. Birkh¨ auser, 1990. 9. A. Cobham. The intrinsic computational diﬃculty of functions. In Proceedings of the second International Congress on Logic, Methodology and Philosophy of Science, pages 24–30, 1965.

Linear Ramiﬁed Higher Type Recursion and Parallel Complexity

21

¨ 10. K. G¨ odel. Uber eine bisher noch nicht ben¨ utzte Erweiterung des ﬁniten Standpunktes. Dialectica, 12:280–287, 1958. 11. M. Hofmann. Programming languages capturing complexity classes. ACM SIGACT News, 31(2), 2000. Logic Column 9. 12. M. Hofmann. Safe recursion with higher types and BCK-algebra. Annals of Pure and Applied Logic, 104:113–166, 2000. 13. D. E. Knuth. Sorting and Searching, volume 3 of The Art of Computer Programming. Addison-Wesley, 2nd edition, 1998. 14. D. Leivant. Stratiﬁed functional programs and computational complexity. In Proc. of the 20th Symposium on Principles of Programming Languages, pages 325–333, 1993. 15. D. Leivant. A characterization of NC by tree recurrence. In Proc. 39th Symposium on Foundations of Computer Science, pages 716–724, 1998. 16. D. Leivant and J.-Y. Marion. A characterization of alternating log time by ramiﬁed recurrence. Theoretical Computer Science, 236:193–208, 2000.

Reﬂective λ-Calculus Jesse Alt and Sergei Artemov Cornell University, Ithaca, NY 14853, U.S.A. {jma35, artemov}@cs.cornell.edu

Abstract. We introduce a general purpose typed λ-calculus λ∞ which contains intuitionistic logic, is capable of internalizing its own derivations as λ-terms and yet enjoys strong normalization with respect to a natural reduction system. In particular, λ∞ subsumes the typed λ-calculus. The Curry-Howard isomorphism converting intuitionistic proofs into λ-terms is a simple instance of the internalization property of λ∞ . The standard semantics of λ∞ is given by a proof system with proof checking capacities. The system λ∞ is a theoretical prototype of reﬂective extensions of a broad class of type-based systems in programming languages, provers, AI and knowledge representation, etc.

1

Introduction

According to the Curry-Howard isomorphism, the calculus of intuitionistic propositions (types) and the calculus of typed λ-terms (proof terms) constitute a pair of isomorphic though distinct structures. Combining those logical and computational universes has been considered a major direction in theoretical logic and applications (propositions-as-types, proofs-as-programs paradigms, etc., cf. [5,7,11,12]). Modern computational systems are often capable of performing logical derivations, formalizing their own derivations and computations, proof and type checking, normalizing λ-terms, etc. A basic theoretical prototype of such a system would be a long anticipated joint calculus of propositions (types) and typed λ-terms (proofs, programs). There are several natural requirements for such a calculus raising from the intended reading of the type assertion t : F as a proposition t is a proof of F. 1. A type assertion t : F should be treated as a legitimate proposition (hence a type). The intended informal semantics of t : F could be t is a proof of F or t has type F. In particular, t : F could participate freely in constructing new types (propositions). Such a capacity would produce types containing λ-terms (proofs, programs) inside. For example, the following types should be allowed t : F → s : G, t : F ∧ s : G, s : (t : F ), etc. In programmistic terms this means a possibility of encoding computations inside types. A system should contain

The research described in this paper was supported in part by ARO under the MURI program “Integrated Approach to Intelligent Systems”, grant DAAH04-96-1-0341, by DARPA under program LPE, project 34145.

R. Kahle, P. Schroeder-Heister, and R. St¨ ark (Eds.): PTCS 2001, LNCS 2183, pp. 22–37, 2001. c Springer-Verlag Berlin Heidelberg 2001

Reﬂective λ-Calculus

23

both the intuitionistic logic (as a calculus of types) and the simply typed λ-calculus. 2. Such a system should contain the reﬂection principle t : F → F representing a fundamental property of proofs if t is a proof of F then F holds. An alternative type-style reading of this principle says if t of type F then F is inhabited. 3. A system should contain the explicit proof checking (the type checking) operation “!” and the principle t : F → !t : (t : F ). The informal reading of “!” is that given a term t the term !t describes a computation verifying t : F (i.e. that t is a proof of F , or that t has type F ). The proof checking and the reﬂection principles enable us to naturally connect relevant types up and down from a given one. Such a possibility has been partly realized by means of modal logic in modal principles ✷F → F and ✷F → ✷✷F respectively, though this presentation lacks the explicit character of typed terms (cf. [3,6]). 4. A system should accommodate the Curry-Howard isomorphism that maps natural derivations in intuitionistic logic to well deﬁned typed λ-terms. A fundamental closure requirement suggests generalizing the Curry-Howard isomorphism to the Internalization Property of the system: if A1 , A2 , . . . , An B then for fresh variables x1 , x2 , . . . , xn and some term t(x1 , x2 , . . . , xn ) x1 : A1 , x2 : A2 , . . . , xn : An t(x1 , x2 , . . . , xn ) : B. 5. Desirable properties of terms in such system include strong normalizability with respect to β-reduction, projection reductions, etc., as well as other natural properties of typed λ-terms. The main goal of this paper is to ﬁnd such a system. The reﬂective λ-calculus λ∞ introduced below is the minimal system that meets these speciﬁcations. The Logic of Proofs LP ([1,2,3]) where proofs are represented by advanced combinatory terms (called proof polynomials), satisfy properties 1–4 above. The property 5 is missing in LP since the combinatory format does not admit reductions and thus does not leave a room for nontrivial normalizations. Reﬂexive λ-terms correspond to proof polynomials over intuitionistic logic in the basis {→, ∧}. Those polynomials are built from constants and variables by two basic operations: “·” (application), “!” (proof checker). The logical identities for those proof polynomials are described by the corresponding fragment of the Logic of Proofs LP. In LP the usual set of type formation rules is extended by a new one: given a proof polynomial p and formula F build a new type (propositional formula) p : F . Valid identities in this language are given by propositional formulas in the extended language generated by the calculus having axioms A0. A1. A2. A3.

Axiom schemes and rules of intuitionistic logic t:F → F t : (F → G) → (s : F → (t·s) : G) t : F → !t : (t : F )

“veriﬁcation” “application” “proof checker”

24

J. Alt and S. Artemov

Rule axiom necessitation: given a constant c and an axiom F from A0–A3 infer c : F . The standard semantics of proof polynomials is operations on proofs in a proof system containing intuitionistic logic. The operation “application” has the usual meaning as applying a proof t of F → G to a proof s of F to get a proof t · s of G. The “proof checking” takes a proof t of F and returns a proof !t of the sentence t is a proof of F . Logic of Proofs in the combinatory format ﬁnds applications in those areas where modal logics, epistemic logics, logics of knowledge work. The λ-version of the whole class of proof polynomials is not normalizing. Indeed, the important feature of proof polynomials is their polymorphism. In particular, a variable can be assigned a ﬁnite number of arbitrary types. If a variable x has two types A and A → A then the λ-term (λx.xx) · (λx.xx) does not have a normal form. In order to ﬁnd a natural normalizing subsystem we limit our considerations to λ-terms for single-conclusion (functional) proof systems, i.e. systems where each proof proves only one theorem. Such terms will have unique types. Proof polynomials in the combinatory format for functional proof systems has been studied in [8,9]. Requirements 1–4 above in the λ-term format inevitably lead to the system λ∞ below. The key idea of having nested copies of basic operations on λ-terms in λ∞ can be illustrated by the following examples. By the Internalization Property, a propositional derivation A → B, A B yields a λ-term derivation1 x1 : (A → B), y1 : A (x1 ◦ y1 ) : B, which yields the existence of a term t(x2 , y2 ) such that x2 : x1 : (A → B), y2 : y1 : A t(x2 , y2 ) : (x1 ◦ y1 ) : B. (here and below “:” is meant to be right-associative). Naturally, we opt to accept such t as a basic operation and call it ◦2 . The deﬁning identity for ◦2 is thus x2 : x1 : (A → B), y2 : y1 : A (x2 ◦2 y2 ) : (x1 ◦ y1 ) : B, or, in the alternative notation tF for type assigmnents xA→B

x2 1

yA

B

, y2 1 (x2 ◦2 y2 )(x1 ◦y1 ) .

Likewise, the Internalization Property yields the existence of the operation ◦3 such that x3 : x2 : x1 : (A → B), y3 : y2 : y1 : A (x3 ◦3 y3 ) : (x2 ◦2 y2 ) : (x1 ◦ y1 ) : B Similar nested counterparts appear for λ-abstraction, pairing, and projections. 1

Here “◦” denotes application on λ-terms.

Reﬂective λ-Calculus

25

New series of operations are generated by the reﬂection and proof checking principles. The reﬂection has form t : A A. The internalized version of this derivation gives a unary operation ⇓ such that x1 : t : A ⇓x1 : A. Likewise, for some unary operation ⇓2 x2 : x1 : t : A ⇓2 x2 : ⇓x1 : A, etc. The proof checking derivation t : A !t : t : A gives rise to a unary operation ⇑ such that x1 : t : A ⇑x1 : !t : t : A. Further application of Internalization produces ⇑2 , ⇑3 , etc. such that x2 : x1 : t : A ⇑2 x2 : ⇑x1 : !t : t : A, x3 : x2 : x1 : t : A ⇑3 x3 : ⇑2 x2 : ⇑x1 : !t : t : A, etc. Theorem 1 below demonstrates that such a set of nested operations on λterms is in fact necessary and suﬃcient to guarantee the Internalization Property for the whole of λ∞ . Therefore, there is nothing arbitrary in this set, and nothing is missing there either. Normalization of terms depends upon a choice of reductions, which may vary from one application to another. In this paper we consider a system of reductions motivated by our provability reading of λ∞ . We consider a normalization process as a kind of search for a direct proof of a given ﬁxed formula (type). In particular, we try to avoid changing a formula (type) during normalization. This puts some restriction on our system of reductions. As a result, the reﬂective λ-terms under the chosen reductions are strongly normalizable, but not conﬂuent. A given term may have diﬀerent normal forms. An additional motivation for considering those reductions is that they extend the usual set of λ-calculus reductions and subsume strong normalization for such components of λ∞ as the intuitionistic calculus and the simply typed λ-calculus.

2

Reﬂective λ-Calculus

The reﬂective λ-calculus λ∞ below is a joint calculus of propositions (types) and proofs (λ-terms) with rigid typing. Every term and all subterms of a term carry a ﬁxed type. In other words, in λ∞ we assume a Church style rigid typing rather than a Curry style type assignment system.

26

2.1

J. Alt and S. Artemov

Types and Typed Terms

The language of reﬂective λ-calculus includes propositional letters p1 , p2 , p3 , . . . type constructors (connectives) →, ∧ term constructors (functional symbols): unary ! , ⇑n , ⇓n , π n0 , π n1 ; binary ◦n , pn , for n = 1, 2, 3 . . . operator symbols ‘:’, λ1 , λ2 , . . ., λn , . . .; a countably inﬁnite supply of variables x1 , x2 , x3 , . . . of each type F (deﬁnition below), each variable x is a term of its unique pre-assigned type. Types and (well-typed, well-deﬁned, well-formed) terms are deﬁned by a simultaneous induction according to the calculus λ∞ below. 1. Propositional letters are (atomic) types 2. Types (formulas) F are built according to the grammar F = p | F → F | F ∧ F | t : F, where p is an atomic type, t a well-formed term having type F . Types of format t : F where t is a term and F a type are called type assertions or quasi-atomic types. Note that only correct type assertions t : F are syntactically allowed inside types. The informal semantics for t : F is t is a proof of F ; so a formula tn : tn−1 : . . . : t1 : A can be read as “tn is a proof that tn−1 is a proof that ... is a proof that t1 proves A”. For the sake of brevity we will refer to types as terms of depth 0. 3. Inhabited types and well-formed terms (or terms for short) are constructed according to the calculus λ∞ below. A derivation in λ∞ is a rooted tree with nodes labelled by types, in particular, type assertions. Leaves of a derivation are labelled by axioms of λ∞ which are arbitrary types or type assertions x : F where F is a type and x a variable of type F . Note that the set of axioms is thus also deﬁned inductively according to λ∞ : as soon as we are able to establish that F is a type (in particular, for a quasi-atomic type s : G this requires establishing by means of λ∞ that s indeed is a term of type G), we are entitled to use variables of type F as new axioms. A context is a collection of quasi-atomic types x1 : A1 , x2 : A2 , . . . , xn : An where xi , xj are distinct variables for i = j. A derivation tree is in a context Γ if all leaves of the derivation are labelled by some quasi-atomic types from Γ . A step down from leaves to the root is performed by one of the inference rules of λ∞ . Each rule comes in levels n = 0, 1, 2, 3, . . .. A rule has one or two premises which are types (in particular, type assertions), and a conclusion. The intended reading of such a rule is that if premises are inhabited types, then the conclusion is also inhabited. If the level of a rule is greater than 0, then the premise(s) and the conclusion are all type assertions. Such a rule is regarded also as a term formation rule with the intended reading: the conclusion t : F is a correct type assertion provided the premise(s) are correct.

Reﬂective λ-Calculus

27

If t : F appears as a label in (the root of) a derivation tree, we say that t is a term of type F . We also refer to terms as well-deﬁned, well-typed, well-formed terms. In λ∞ we use the natural deduction format, where derivations are represented by proof trees with assumptions, both open (charged) and closed (discharged). We will also use the sequent style notation for derivations in λ∞ by reading Γ F as an λ∞ -derivation of F in Γ . Within the current deﬁnition below we assume that n = 0, 1, 2, . . . and v = (v1 , v2 , . . . , vn ). In particular, if n = 0 then v is empty. We also agree on the following vector-style notations: t : A denotes tn : tn−1 : . . . : t1 : A (e.g. t : A is A, when n = 0), t : {A1 , A2 , . . . , An } denotes {t1 : A1 , t2 : A2 , . . . :, tn : An }, λn x.t : B denotes λn xn .tn : λn−1 xn−1 .tn−1 : . . . : λx1 .t1 : B, (t ◦n s) : B denotes (tn ◦n sn ) : (tn−1 ◦n−1 sn−1 ) : . . . : (t1 ◦s1 ) : B, ⇑n t : B denotes ⇑n tn : ⇑n−1 tn−1 : . . . : ⇑t1 : B, likewise for all other functional symbols of λ∞ . Derivations are generated by the following clauses. Here A, B, C are formulas, Γ a ﬁnite set of types, s, t, u are n-vectors of pseudo-terms, x are n-vectors of variables, n = 0, 1, 2, . . .. Natural deduction rule (Ax) (λ)

x:A

Its sequent form Γ x : A, if x : A is in Γ

t:B n

λ x.t : (A→B)

provided xn : xn−1 : . . . : x1 : A, xi occurs free neither in tj for i = j nor in A → B. Premises corresponding to xn : xn−1 : . . . : x1 : A (if any) are discharged. In the full sequent form this rule is Γ , xn : xn−1 : . . . : x1 : A tn : tn−1 : . . . : t1 : B Γ λn xn .tn : λn−1 xn−1 .tn−1 : . . . : λx1 .t1 : (A → B) where none of x occurs free in the conclusion sequent. All the rules below do not bind/unbind variables. t : (A → B) s : A

(App)

(p)

n

(t ◦ s) : B t:A n

s:B

p (t, s) : (A∧B)

Γ t : (A → B) Γ s : A Γ (t ◦n s) : B Γ t:A Γ s:B Γ pn (t, s) : (A ∧ B)

28

J. Alt and S. Artemov

(π)

(⇑)

(⇓)

t : (A0 ∧ A1 ) π ni t : Ai

Γ t : (A0 ∧ A1 )

(i = 0, 1)

Γ π ni t : Ai

(i = 0, 1)

t:u:A

Γ t:u:A

⇑ t : !u : u : A

Γ ⇑n t : !u : u : A

n

t:u:A

Γ t:u:A

n

Γ ⇓n t : A

⇓ t:A

Remark 1. The intuitionistic logic for implication/conjunction and λ-calculus are the special cases for rules with n = 0 and n = 1 only, respectively, if we furthermore restrict all of the displayed formulas to types which do not contain quasi-atoms. Example 1. Here are some examples of λ∞ -derivations in the sequent format (cf. 3.2). We skip the trivial axiom parts for brevity. y : x : A ⇓y : A 1)

λy.⇓y : (x : A → A)

y : x : A ⇑y : !x : x : A 2)

λy.⇑y : (x : A → !x : x : A)

However, one can derive neither A → x : A, nor λx.!x : (A → x : A), since x occurs free there. u : x : A, v : y : B p2 (u, v) : p(x, y) : (A ∧ B) u : x : A λ2 v.p2 (u, v) : λy.p(x, y) : (B → (A ∧ B)) 3)

λ2 uv.p2 (u, v) : λxy.p(x, y) : (A → (B → (A ∧ B))) u : x : A, v : y : B p2 (u, v) : p(x, y) : (A ∧ B) u : x : A, v : y : B ⇑p2 (u, v) : !p(x, y) : p(x, y) : (A ∧ B)

4)

λuv.⇑p2 (u, v) : (x : A → (y : B → !p(x, y) : p(x, y) : (A ∧ B)))

Note that unlike in the previous example we cannot introduce λ2 in place of λ at the last stage here since the resulting sequent would be λ2 uv.⇑p2 (u, v) : λxy.!p(x, y) : (A → (B → p(x, y) : (A ∧ B))) containing abstraction over variables x, y which are left free in the conclusion, which is illegal. Here is an informal explanation of why such a derivation should not be permitted. Substituting diﬀerent terms for x and y in the last sequent produces diﬀerent types from A → (B → p(x, y) : (A ∧ B)), whereas neither of the terms λxy.!p(x, y) and λ2 uv.⇑p2 (u, v) changes after such substitutions. This is bad syntactically, since the same terms will be assigned diﬀerent types. Semantically this is bad either, since this would violate the one proof - one theorem convention.

Reﬂective λ-Calculus

29

Proposition 1. (Closure under substitution) If t(x) is a well-deﬁned term, x a variable of type A, s a term of type A free for x in t(x), then t(s) is a well-deﬁned term of the same type as t(x). Proposition 2. (Uniqueness of Types) If both t : F and t : F are well-typed terms, then F ≡ F . Theorem 1. (Internalization Property for λ∞ )

Let λ∞ derive

A1 , A2 , . . . , Am B. Then one can build a well-deﬁned term t(x1 , x2 , . . . , xm ) with fresh variables x such that λ∞ also derives x1 : A1 , x2 : A2 , . . . , xm : Am t(x1 , x2 , . . . , xm ) : B. Proof. We increment n at every node of the derivation A1 , A2 , . . . , Am B. The base case is obvious. We will check the most principal step clause (λ) leaving the rest as an exercise. Let the last step of a derivation be Γ , yn : yn−1 : . . . : y1 : A tn : tn−1 : . . . : t1 : B Γ λn yn .tn : λn−1 yn−1 .tn−1 : . . . : λy1 .t1 : (A → B)

.

By the induction hypothesis, for some term s(x, xm+1 ) of fresh variables x, xm+1 x : Γ , xm+1 : yn : yn−1 : . . . : y1 : A s(x, xm+1 ) : tn : tn−1 : . . . : t1 : B. Apply the rule (λ) for n + 1 to obtain x : Γ λn+1 xm+1 .s : λn yn .tn : λn−1 yn−1 .tn−1 : . . . : λy1 .t1 : (A → B), and put t(x1 , x2 , . . . , xm ) = λn+1 xm+1 .s(x, xm+1 ). 2.2

Reductions in the λ∞ Calculus

Deﬁnition 1. For n = 1, 2, . . ., the redexes for λ∞ and their contracta (written as t t , for t a redex, t a contractum of t) are: – (λn xn .tn )◦n sn : . . . : (λx1 .t1 )◦s1 : F tn [sn /xn ] : . . . : t1 [s1 /x1 ] : F (βn -contraction) pn−1 (tn−1 , t1n−1 ) : . . . : π i p(t10 , t11 ) : F – π ni pn (tn0 , tn1 ) : π n−1 0 i n−1 1 n ti : t i : . . . : ti : F, i = 0, 1 – ⇓n ⇑n tn : ⇓n−1 ⇑n−1 tn−1 : . . . : ⇓⇑t1 : F tn : tn−1 : . . . : t1 : F Before deﬁning the reduction relation on reﬂective λ-terms (Deﬁnition 5) we will come with some motivations (Remarks 2 and 3). Remark 2. The system should allow types of normalized terms to contain terms which are not normal. The object, then, is to normalize a term of any type, regardless of the redundancy of the type, and focus on eliminating redundancy in the term. It has been noted, for instance, that the statement of the normalization property for a term system, contains “redundancy”, because it says that something which is not normal, is equivalent to a normal thing.

30

J. Alt and S. Artemov

Remark 3. In the simply-typed and untyped λ-calculi, reduction of terms is deﬁned as contraction of the redexes which occur as subterm occurrences of the term. For λ∞ , the situation is a little trickier. We want to be sure that, when reducing a term tn of type tn−1 : . . . : t1 : A, we end up with a well-typed term tn having type tn−1 : . . . : t1 : A. I.e., we don’t want the formula A to change under reduction, while the intermediary terms tj , may be allowed to change in a predictable way. An example, illustrating the diﬃculties arising when we allow any subterm occurrence of a redex to contract, is the λ∞ -term x3 : x2 : x1 : A ⇑2 x3 : ⇑x2 : !x1 : x1 : A x3 : x2 : x1 : A ⇓2 ⇑2 x3 : ⇓⇑x2 : x1 : A λx3 .⇓2 ⇑2 x3 : (x2 : x1 : A → ⇓⇑x2 : x1 : A) Let us use a blend of type assertion notations tF and t : F to show the type of the subterm ⇓2 ⇑2 x3 of the resulting term more explicitly. [λx3 .(⇓2 ⇑2 x3 )⇓⇑x2 :x1 :A ](x2:x1:A→⇓⇑x2:x1:A) In principle, the subterm (⇓2 ⇑2 x3 )⇓⇑x2 :x1 :A is a redex. However, from the proof theoretical point of view it would be a mistake to allow the whole term to reduce to [λx3 .x3 ](x2:x1:A→x2:x1:A) . Indeed, the formula (type) τ x2 : x1 : A → ⇓⇑x2 : x1 : A is a nontrivial formalized special case of so-called subject extension. We do not want to change this formula (type) in a normalization process to x2 : x1 : A → x2 : x1 : A which is a trivial proposition. Speaking proof theoretically, while normalizing we are looking for a normal proof of a given proposition (here it is formula τ ) rather than changing a proposition itself in a process of ﬁnding a “better” proof of it. Abandoning τ in the normalization process would not allow us to ﬁnd a natural normal inhabitant (normal proof) of τ . The principal diﬃculty here is that the main term is “lower level” than the subterm occurrence being contracted. Accordingly, we develop a notion of subterm occurrences sitting properly in a term. Deﬁnition 2. For t a well-deﬁned λ∞ -term, t is of level n (written, ev(t) = n) if the bottom rule in the derivation tree has superscript n. Deﬁnition 3. For t0 a subterm occurrence of a λ∞ -term t, with ev(t0 ) = n, we say that t0 is properly embedded in t (t0 p t) if there are no subterm occurrences m in t containing t0 of the forms: λm x.s, s ◦m r, pm (s, r), π m i s, ⇓ s, with m < n

Reﬂective λ-Calculus

31

Speaking vaguely, we require that redexes be properly embedded in all subterms except, may be, the “proof checkers” ⇑m s. We will show below that this requirement suﬃces for type preservation, and strong normalization of λ∞ -terms. We may now deﬁne reduction of λ∞ -terms. Deﬁnition 4. (a) For any well-deﬁned λ∞ -terms t and t , t one-step reduces to t (t 1 t ) if t contains a properly embedded subterm occurrence s of the form of one of the redexes above, s s , and t ≡ t[s /s]. (b) The reduction relation is the reﬂexive and transitive closure of 1 . Equipped with the above-deﬁned notion of reduction, λ∞ enjoys (suitably modiﬁed versions of) the most important properties of the simply typed lambda calculus. The elementary property of type preservation under reduction holds, in a modiﬁed form, namely, for t : F a well-typed term, if t 1 t then t : F is well-typed, for a naturally determined type F . More precisely, Proposition 3. (Type Preservation) Let tn be a well-typed term of level n, having type tn−1 : . . . : t1 : A. If tn 1 tn , then tn is a well-typed level n term. Furthermore, tn has type tn−1 : . . . : t1 : A, with ti 1 ti or ti ≡ ti , for 1 ≤ i ≤ n − 1. Proof. tn 1 tn , by deﬁnition, only if there exists sn p tn , sn sn , and tn ≡ tn [sn /sn ]. We proceed by induction on |tn |, and on the number of subterm occurrences between tn and sn , and construct a derivation in λ∞ of the new term tn . The construction of this derivation is analogous to the construction of derivations in intuitionistic logic under detour reduction. We get a form of subject reduction as an immediate consequence: Corollary 1. (Subject Reduction) Γ t : A ⇒ Γ t : A, for tn 1 tn . Remark 4. It is easy to see that the derivation of tn obtained in the proof above, is uniquely determined by tn , and the derivation of tn . In this way, we associate to each reduction of terms, a corresponding reduction of derivations. Under this operation of simultaneous term and derivation reduction, we see how the internalization property of λ∞ is a generalization of the Curry-Howard isomorphism. Namely, the square in Figure 1 commutes, where ι is the map given by the Internalization Property, and 1 is the map given by one-step reduction. Example 2. We may modify the term from the above example, to obtain a term with a properly embedded redex: x3 : x2 : x1 : A ⇑2 x3 : ⇑x2 : !x1 : x1 : A x3 : x2 : x1 : A ⇓2 ⇑2 x3 : ⇓⇑x2 : x1 : A λ2 x3 .⇓2 ⇑2 x3 : λx2 .⇓⇑x2 : (x1 : A → x1 : A)

32

J. Alt and S. Artemov

Fig. 1. Generalization of the Curry-Howard isomorphism

The (properly embedded) redex ⇓2 ⇑2 x3 contracts to x3 , and the term derivation and type are modiﬁed accordingly: x3 : x2 : x1 : A x3 : x2 : x1 : A λ2 x3 .x3 : λx2 .x2 : (x1 : A → x1 : A) The result really is a normal proof of the statement inside the parentheses. Proposition 4. The reduction relation is not conﬂuent. Proof. By a counterexample. Consider the following well-deﬁned terms (missing types can be easily recovered). p2 (x2 , y2 ) : p(x1 , y1 ) : (A ∧ B) λx2 .p2 (x2 , y2 ) : (x1 : A → p(x1 , y1 ) : (A ∧ B)) λx2 .p2 (x2 , y2 )) ◦ z : p(x1 , y1 ) : (A ∧ B) λ2 y2 .[(λx2 .p2 (x2 , y2 )) ◦ z] : λy1 .p(x1 , y1 ) : (B → (A ∧ B)) If we call the above term t2 : t1 : (B → (A ∧ B)), then t2 ◦2 π 21 p2 (u2 , w2 ) : t1 ◦ π 1 p(u1 , w1 ) : (A ∧ B) reduces to both: (1) t2 [π 21 p2 (u2 , w2 )/y2 ] : t1 [π 1 p(u1 , w1 )/y1 ] : (A ∧ B) and (2) t2 ◦2 u2 : t1 ◦ u1 : (A ∧ B), which further reduces to (3) t2 [u2 /y2 ] : t1 [u1 /y1 ] : (A ∧ B). And, there’s no way to reduce (1) to (3), since π 21 p2 (u2 , w2 ) isn’t properly embedded in t2 [π 21 p2 (u2 , w2 )/y2 ].

Reﬂective λ-Calculus

3

33

Strong Normalization of λ∞ -Terms

Deﬁnition 5. (a) A reduction sequence is any sequence of terms t0 , . . . , tn . . . . such that, for 0 ≤ j < n, tj 1 tj+1 . (b) A term t is strongly normalizing (t ∈ SN) if every possible reduction sequence for t is ﬁnite. (c) If t is strongly normalizing, ν(t) = the least n such that every reduction sequence for t terminates in fewer than n steps. We now show that all terms of λ∞ are strongly normalizing. The proof follows the method of Tait (cf. [7]). This method deﬁnes a class of reducible terms by induction on type. We are concerned with types, but will ignore variations in type, up to a point. Deﬁnition 6. More precisely, a term t is n-cushioned of type A if t has type tn−1 : . . . : t1 : A, where the ti are λ∞ -terms, for 1 ≤ i ≤ n − 1. Note that this is a weaker requirement than ev(t) = n. Indeed, ev(t) = n implies t is k-cushioned, for k ≤ n, and it could also be that t is m-cushioned, for some m > n. For the proof, we’ll deﬁne sets REDnT of reducible terms for n-cushioned terms of type T , by induction on T . We then prove some properties of these sets of terms, including the property that all terms in the sets are strongly normalizing. Finally, strong normalization of the calculus is established by showing that all λ∞ -terms are in a set REDnT . Deﬁnition 7. If T is a type, we deﬁne the depth of T , |T |, inductively: |p| = 0, for p an atomic proposition |A ∧ B| = |A → B| = max(|A|, |B|) + 1 |u : A| = |A| + 1 Deﬁnition 8. The sets REDnT of reducible n-cushioned terms of type T are deﬁned by induction on |T |: 1. 2. 3. 4.

For For For For

t t t t

of of of of

atomic type p, t ∈ REDnp if t is strongly normalizing. type A → B, t ∈ REDnA→B if, for all s ∈ REDnA , t ◦n s ∈ REDnB . type A0 ∧ A1 , t ∈ REDnA0 ∧A1 if π ni t ∈ REDnAi , for i = 0, 1. type u : A, t ∈ REDnu:A if ⇓n t ∈ REDnA and t ∈ REDn+1 A

Proposition 5. For t a well-typed term, if t is strongly normalizing, then ⇓n t is too. Proof. If t is not of the form ⇑n t0 , then every reduction sequence for ⇓n t has less or equal to ν(t) terms in it. If t is of the form ⇑n t0 , then every reduction sequence for ⇓n t has length ≤ ν(t) + 1. Deﬁnition 9. A term t is neutral if t is not of the form λn x.t0 , pn (t0 , t1 ), or ⇑n t0 .

34

J. Alt and S. Artemov

Proposition 6. For T any type, all terms t ∈ REDnT have the following properties: (CR 1) If t ∈ REDnT , then t is strongly normalizing. (CR 2) If t ∈ REDnT and t t , then t ∈ REDnT , for t : un−1 : un−2 : . . . : u1 : T t : un−1 : un−2 : . . . : u1 : T (CR 3) If t is neutral, and t ∈ REDnT for all t such that t 1 t , then t ∈ REDnT (CR 4) If t ∈ REDnT , then t ∈ REDn−1 u1 :T , for t : un−1 : un−2 : . . . : u1 : T . Proof. Proof by induction on |T |. Step 1 T is atomic, i.e. T ≡ p. (CR 1) Trivial. (CR 2) If t is SN, and t t , then t is SN, so t is reducible. (CR 3) Let M = max(ν(t ) | t 1 t ). There are ﬁnitely many t such that t 1 t , so M is ﬁnite. And, ν(t) ≤ M + 1. (CR 4) t ∈ REDnp yields t is SN thus ⇓n−1 t is SN, by above proposition. and t ∈ REDn−1 Therefore, ⇓n−1 t ∈ REDn−1 p u1 :p Step 2 T ≡ (A → B). (CR 1) Let x be a variable of type A. Then t◦nx ∈ REDnB , and by induction, t◦nx is SN. Since every reduction sequence for t is embedded in a reduction sequence of t◦n x, t is SN. This argument works since t t implies that the subterm occurrence being contracted is properly embedded in t, which means this subterm occurrence must have lev < n + 1. Under those conditions t t implies t◦n x t ◦n x. (CR 2) Let t t for t : un−1 : un−2 : . . . : u1 : T , and take s ∈ REDnA for s : wn−1 : wn−2 : . . . : w1 : A. Then t◦n s ∈ REDnB , and t◦n s t ◦n s. By induction, t ◦n s is reducible. Since s was arbitrary, t is reducible. (CR 3) Let t be neutral, and suppose that t is reducible, for all t such that t 1 t . Let s ∈ REDnA . By induction, s is SN. We prove, by induction on ν(s) that if t ◦n s 1 (t ◦n s) , (t ◦n s) is reducible. There are two possibilities for (t ◦n s) : 1. (t ◦n s) is t ◦n s, with t 1 t . Then t is reducible, so t ◦n s is. 2. (t ◦n s) is t ◦n s , with s 1 s . Then s is reducible, so t ◦n s is. By the induction hypothesis, t ◦n s is reducible, because it’s neutral. Thus, t is reducible. n−1 (CR 4) We need to show that ⇓n−1 t ∈ REDn−1 A→B . Let r ∈ REDA . By induction, r is SN; and by (CR 1), t is SN. Thus, by the above proposition, ⇓n−1 t is SN, and we can induct on ν(r) + ν(⇓n−1 t). Base: ν(r) + ν(⇓n−1 t) = 0 . Then ⇓n−1 t ◦n−1 r is normal (and it is neutral), so n−1 by induction, ⇓n−1 t◦n−1 r ∈ REDB . Induction: in one step, ⇓n−1 t◦n−1 r reduces to • (⇓n−1 t) ◦n−1 r - reducible by induction • ⇓n−1 t ◦n−1 r - reducible by induction. n−1 for all Hence, by induction hypothesis (CR 3), ⇓n−1 t ◦n−1 r ∈ REDB n−1 n−1 n−1 n−1 r ∈ REDA . Thus, ⇓ t ∈ REDA→B , and t ∈ REDu1 :(A→B) . Step 3 T ≡ (A ∧ B).

Reﬂective λ-Calculus

35

(CR 1)–(CR 3) Similar to the previous step. Note that t t yields π ni t π ni t , for t : un−1 : un−2 : . . . : u1 : (A0 ∧ A1 ). (CR 4) By (CR 1), t is SN. We need to show that ⇓n−1 t ∈ REDn−1 A0 ∧A1 , i.e. n−1 n−1 n−1 that π n−1 t) ∈ RED , for i = 0, 1. By induction on ν(⇓ t). Base (⇓ i Ai n−1 n−1 n−1 ν(⇓ t) is both neutral and normal. By I.H. t) = 0. Then π i (⇓ n−1 (CR 3), π n−1 (⇓n−1 t) ∈ REDn−1 (⇓n−1 t) i Ai . Induction: in one step π i n−1 n−1 reduces to π i (⇓ t ) which is reducible, by I.H.. Step 4 T ≡ (u : A). (CR 1) t ∈ REDnu:A yields t ∈ REDn+1 A , thus. by I.H., t is SN. (CR 2) Let t t . By I.H. (CR 2), t ∈ REDn+1 A . By I.H. (CR 4), t ∈ n REDu :A . (CR 3) Suppose t ∈ REDnu :A for all t such that t 1 t . Then t ∈ REDn+1 A for all t such that t 1 t . By I.H. (CR 3), t ∈ REDn+1 . By I.H. (CR A 4), t ∈ REDnu:A . (CR 4) Let t ∈ REDnu:A . By (CR 1), t is SN. Thus, by Proposition 5, ⇓n−1 t n−1 is SN. We need to show that ⇓n−1 t ∈ REDu:A , i.e. that ⇓n−1 t ∈ REDnA and n−1 ⇓n−1 ⇓n−1 t ∈ REDn−1 t) A . Both are easily shown by induction on ν(⇓ n−1 n−1 and on ν(⇓ ⇓ t), respectively, by using (CR 3) inductively. Proposition 7. 1. If, for all u ∈ REDnA , t[u/x] ∈ REDnB , then λn x.t ∈ REDnA→B . 2. If t0 , t1 are reducible, then pn (t0 , t1 ) is reducible. 3. If t ∈ REDnu:A , then ⇑n t ∈ REDn!u:u:A . 4. If t ∈ REDnA and m < n, then ⇑m t ∈ REDn+1 A . Proof. For part (1): Let u ∈ REDnA . We’ll show that (λn x.t) ◦n u is reducible, by induction on ν(u) + ν(t). (λn x.t) ◦n u 1 : – t[u/x], which is reducible by hypothesis. – (λn x.t ) ◦n u with t 1 t . By induction, this is reducible. – (λn x.t) ◦n u with u 1 u . By induction, this is reducible. Parts (2) and (3) are established similarly. Part 4 is by induction on |A|. The case A is atomic is handled in the obvious way, implications and conjunctions are handled by induction on ν(t) + ν(r) and ν(t) respectively. Finally, the case where A is u : B follows from the induction hypothesis. Proposition 8. Let t be a term. Suppose the free variables of t are among x1 , . . . , xk , of levels n1 , . . . , nk and having types U1 , . . . , Uk . Let u1 , . . . , uk be terms with u1 ∈ REDnU11 , . . . , uk ∈ REDnUkk . Then the term t[u1 /x1 , . . . , uk /xk ] (written t[u/x]), is reducible. Proof. Step 1 t entered by (Ax). Trivial. Step 2 Let t be λn yn .t0n : λn−1 yn−1 .t0n−1 : . . . : λy1 .t01 : (A → B). By I.H., t0n [vn /yn , u/x] is reducible (i.e., is in some reducibility class) for all vn ∈ REDm T , where m is the level of yn , and T is yn ’s type (so yn has type rm−1 : . . . : r1 : T , and m ≥ n). By (CR 4), and the deﬁnition of the classes REDkw:F , this implies that t0n [vn /yn , u/x] is reducible for all vn ∈ REDnA . Now, using (CR 4) and the deﬁnition again, t0n [vn /yn , u/x] is reducible implies that t0n [vn /yn , u/x] ∈ REDnB . By Proposition 7, λn yn .t0n [u/x](≡ t[u/x]) is reducible.

36

J. Alt and S. Artemov

Step 3 The other six cases are handled similarly, using either the deﬁnition of the reducibility classes or Proposition 7. As a corollary, we have: Theorem 2. All well-deﬁned terms of λ∞ are strongly normalizable.

4

Conclusion

1. Proof polynomials from the Logic of Proofs ([3]) represent the reﬂective idea in the combinatory terms format, with many postulated constant terms and three basic operations only. Such an approach turned out to be fruitful in proof theory, modal and epistemic logics, logics of knowledge, etc. Proof polynomials are capable of extracting explicit witnesses from any modal derivation and thus may be regarded as a logical basis for the quantitative theory of knowledge. On the other hand, such areas as typed programming languages, theorem provers, veriﬁcation systems, etc., use the language of λ-terms rather than combinatory terms. Technically speaking, in the λ format there are no postulated constants, but there are many (in our case inﬁnitely many) operations on terms. Those operations create certain redundancies in terms, and the theory of eliminating those redundancies (i.e. the normalization process) plays an important role. Reﬂective λ-calculus λ∞ is a universal superstructure over formal languages based on types and λ-terms. It oﬀers a much richer collection of types, in particular the ones capable of encoding computations in types. We wish to think that a wide range of systems based on types and terms could make use of such a capability. 2. The very idea of reﬂective terms is native to both provability and computability. The extension of the Curry-Howard isomorphism oﬀered by the reﬂective λ-calculus λ∞ captures reﬂexivity in a uniform abstract way. This opens a possibility of ﬁnding more mutual connections between proofs and programs. In this paper we have built strongly normalizing reﬂective λ-terms that correspond to some proper subclass of proof polynomials. It is pivotal to study exact relations between λ∞ , Intuitionistic Modal Logic and the Intuitionistic Logic of Proofs. Such an investigation could bring important new rules to λ∞ , and eventually to programming languages. 3. Reﬂective λ-calculus is capable of internalizing its own reductions as well as its own derivations. If a term t : F is obtained from t : F by a reduction, then the corresponding derivation (well-formed term) s : t : F can be transformed to a term s : t : F . This takes care of the cases when, for example, an abstraction term is obtained not by the abstraction rule, but by a projection reduction. Such a step can be internalized in λ∞ as well. 4. A more concise equivalent axiomatization of λ∞ could probably be obtained by formalizing Internalization as an atomic rule of inference rather than a derived rule. This route is worth pursuing. 5. There are many natural systems of reductions for reﬂective λ-terms. For this paper we have picked one with well-embedded redexes on the basis of the

Reﬂective λ-Calculus

37

proof theoretical semantics. We conjecture that the system with unlimited reductions enjoys both strong normalization and conﬂuence. Acknowledgment. Sergei Artemov suggested the system λ∞ and wrote sections 1, 2.1, 4. Jesse Alt made a major contribution to ﬁnding the proof of the strong normalization theorem λ∞ and wrote most of sections 2.2, 3. Special thanks are due to Robert Constable and Anil Nerode for supporting this research. The authors are also indebted to Volodya Krupski, Roma Kuznets, Alesha Nogin, Lena Nogina, and the anonymous referee for a reading diﬀerent versions of this paper which led to valuable improvements.

References 1. S. Artemov, “Operational Modal Logic,” Tech. Rep. MSI 95-29, Cornell University, December 1995 http://www.cs.cornell.edu/Info/People/artemov/MSI95-29.ps 2. S. Artemov, “Uniform provability realization of intuitionistic logic, modality and lambda-terms”, Electronic Notes on Theoretical Computer Science, vol. 23, No. 1. 1999 http://www.elsevier.nl/entcs 3. S. Artemov, “Explicit provability and constructive semantics”, The Bulletin for Symbolic Logic, v.7, No. 1, pp. 1-36, 2001 http://www.cs.cornell.edu/Info/People/artemov/BSL.ps. 4. H. Barendregt, “Lambda calculi with types”. In Handbook of Logic in Computer Science, vol.2, Abramsky, Gabbay, and Maibaum, eds., Oxford University Press, pp. 118-309, 1992 5. R. Constable, “Types in logic, mathematics and programming”. In Handbook in Proof Theory, S. Buss, ed., Elsevier, pp. 683-786, 1998 6. D. de Jongh and G. Japaridze, “Logic of Provability”, in S. Buss, ed., Handbook of Proof Theory, Elsevier, pp. 475-546, 1998 7. J.-Y. Girard, Y. Lafont, P. Taylor, Proofs and Types, Cambridge University Press, 1989. 8. V.N. Krupski, “Operational Logic of Proofs with Functionality Condition on Proof Predicate”, Lecture Notes in Computer Science, v. 1234, Logical Foundations of Computer Science’ 97, Yaroslavl’, pp. 167-177, 1997 9. V.N. Krupski, “The single-conclusion proof logic and inference rules speciﬁcation”, Annals of Pure and Applied Logic, v.110, No. 1-3, 2001 (to appear). 10. A. Nerode, “Applied Logic”. In The merging of Disciplines: New Directions in Pure, Applied, and Computational Mathematics, R.E. Ewing, K.I. Gross, C.F. Martin, eds., Springer-Verlag, pp. 127-164, 1986 11. A. Troelstra, “Realizability”. In Handbook in Proof Theory, S. Buss, ed., Elsevier, pp. 407-474, 1998 12. A.S. Troelstra and H. Schwichtenberg, Basic Proof Theory, Cambridge University Press, 1996.

A Note on the Proof-Theoretic Strength of a Single Application of the Schema of Identity uller2 Matthias Baaz1 and Christian G. Ferm¨ 1

Institut f¨ ur Algebra und Computermathematik E118.2, Technische Universit¨ at Wien, A–1040 Vienna, Austria, 2 Institut f¨ ur Computersprachen E185, Technische Universit¨ at Wien, A–1040 Vienna, Austria {baaz,chrisf}@logic.at

Abstract. Every instance of the schema of identity is derivable from identity axioms. However, from a proof theoretic perspective the schema of identity is quite powerful. Even one instance of it can be used to prove formulas uniformly where no ﬁxed number of instances of identity axioms is suﬃcient for this purpose.

1

Introduction

In this paper we investigate the impact of replacing instances of the schema of identity by instances of identity axioms in valid Herbrand disjunctions. More precisely, we consider valid sequents of form Ξ, s = t ⊃ (B(s) ⊃ B(t)) ∃xA(rp , x) where Ξ consists of identity axioms, A is quantiﬁer free, and rp is some “parameter term”, for which the index p can be thought of as its size. Obviously s = t ⊃ (B(s) ⊃ B(t)) can be derived from identity axioms and thus be replaced (in the sequent above) by appropriate instances of identity axioms. We compare the number of formulas in the corresponding Herbrand disjunctions Ξ , s = t ⊃ (B(s) ⊃ B(t)) A(rp , t1 ), . . . , A(rp , tn ) and

Ξ , Π A(rp , t1 ), . . . , A(rp , tn )

respectively, where Ξ , Π consist of instances of identity axioms. On the one hand we provide examples where |Π| (i.e., the number of formulas in Π) cannot be uniformly bounded (i.e., depends on the size of the parameter term rp ). On the other hand we show that if the parameter term is composed of a “fanning out” function symbol then such bounds exist. (We call a unary function symbol f fanning out if f m (x) = f n (x) is provable whenever m = n, for all m, n ∈ N.) The length of a Herbrand disjunction is uniformly bounded by the length of a proof and the logical complexity of the end sequent. (This follows, e.g., R. Kahle, P. Schroeder-Heister, and R. St¨ ark (Eds.): PTCS 2001, LNCS 2183, pp. 38–48, 2001. c Springer-Verlag Berlin Heidelberg 2001

A Note on the Proof-Theoretic Strength of a Single Application

39

from Gentzen’s Midsequent Theorem; see, e.g., [Takeuti, G., 1980].) Therefore our results can be interpreted as statements on the short provability of formulas involving complex terms using the schema of identity, i.e. its proof theoretic strength in the literal sense. In general, the short (uniform) provability is lost when the schema of identity is replaced by identity axioms.

2

Basic Notions

Syntax Terms are built up, as usual, from constant and function symbols. In particular, we will use 0 and c as constant symbols, s and f as unary function symbols, and + and as binary function symbols for which we use inﬁx notation. Atoms (atomic formulas) consist of an n-ary predicate symbol (n ≥ 1) applied to n terms (arguments). Throughout the paper we refer to the binary predicate symbol =, for which we use inﬁx notation, as “identity”. Formulas are either atoms or built nup from atoms using the usual connectives (¬, ∧, ∨, ⊃) and quantiﬁers (∀, ∃). i=1 Ai abbreviates A1 ∧ . . . ∧ An . ¬s = t is written as s = t. Tuples of variables or terms are indicated by over-lines: e.g., ∃xA(x) abbreviates ∃x1 . . . ∃xn A(x1 , . . . , xn ) for some n ≥ 1. By A we denote the number of atoms in a formula A. By an expression we mean either a term or a formula. It is convenient to view an expression as a rooted and ordered tree, where the inner nodes are function symbols (the root possibly is a predicate symbol) and the leaf nodes are constants or variables. A position p in an expression A is a sequence of edges in a path leading from the root to a node np of A. Two positions are overlapping if one is a proper subsequence of the other. In writing A(t1 , . . . , tn ) we implicitly refer, for each i ∈ {1, . . . , n}, to some — possibly empty — set πi of positions in the expression A in which ti occurs, where no two positions in 1≤i≤n πi are overlapping. The indicated positions will be made explicit only when necessary. In reference to A(t1 , . . . , tn ) we denote the result of replacing ti at the corresponding positions πi with the term si by A(s1 , . . . , sn ). (Note that not necessarily all occurrences of ti in A are indicated.) g[s] indicates that the term s occurs as a proper subterm — at certain positions p1 , . . . pn , n ≥ 1 — in g. In reference to g[s] we denote by g[t] the result of replacing s at these positions with the term t. “≡” denotes syntactical identity between expressions. For any term t and unary function symbol f we deﬁne: f 0 (t) ≡ t and f n+1 (t) ≡ f n (f (t)). Similarly if is a binary function symbol (for which we use inﬁx notation) we deﬁne: [t]0 ≡ t and [t]n+1 ≡ (t [t]n ). A variable is called fresh with respect to some context (e.g., a sequent) if it does not occur elsewhere in that context. By a fresh copy F of a formula F we mean a variable renaming copy of F , such that the variables occurring in F do not occur in the context. (Variable) substitutions are functions from variables to terms that are homomorphically extended to expressions and sequences of formulas as usual. The

40

M. Baaz and C.G. Ferm¨ uller

result of applying the substitution σ to an expression E is written as σ(E). We assume familiarity with the concept of a most general (simultaneous) uniﬁer of a ﬁnite set {(E1 , F1 ), . . . , (En , Fn )} of pairs of expressions (see, e.g., [Leitsch, A., 1997]). Axiomatizing Identity The context of our investigation is pure, classical ﬁrst-order logic. However we are mainly interested in the eﬀects of diﬀerent treatments of the identity predicate. We will frequently refer to the following list of axioms, called identity axioms: – – – –

Reﬂexivity: x = x Symmetry: x = y ⊃ y = x Transitivity: (x = y ∧ y = z) ⊃ x = z Congruence (functions): for every n-ary function symbol f and every 1 ≤ i ≤ n: xi = yi ⊃ f (x1 , . . . , xn ) = f (x1 , . . . , xi−1 , yi , xi+1 , . . . xn ) – Congruence (predicates): for every n-ary predicate symbol P and every 1 ≤ i ≤ n: xi = yi ⊃ (P (x1 , . . . , xn ) ⊃ P (x1 , . . . , xi−1 , yi , xi+1 , . . . xn ))

The Classical Sequent Calculus LK As underlying deduction system we will use Gentzen’s (in every sense of the word) classical LK. This, however, is only a matter of taste: our results can be easily translated to other formats of deduction. We will not have to present any formal LK-derivations in detail here and thus simply refer to, e.g., [Takeuti, G., 1980] for formal deﬁnitions of sequents, rules, derivations etc. Sequents are written as Γ ∆, where Γ and ∆ are sequences of formulas. By |Γ | we denote the number of occurrences of formulas in Γ . All tautological, i.e., propositionally valid sequents are (cut-free) derivable in a number of steps depending only on the logical complexity of the formulas in the end sequent. Gentzen’s Midsequent Theorem provides a version of Herbrand’s Theorem for sequents (see [Takeuti, G., 1980]). Note that the sequents in an LK-derivation can be skolemized without increase of proof length and that Herbrand disjunctions can be embedded in “reskolemized” derivations whose length does not depend on the term structure (cf. [Baaz, M. and Leitsch, A., 1994],[Baaz, M. and Leitsch, A., 1999].) Consequently the results below can be re-interpreted for quantiﬁed formulas.

3

One Application of the Schema of Identity

The schema of identity is given by x = y ⊃ (A(x) ⊃ A(y))

(ID)

A Note on the Proof-Theoretic Strength of a Single Application

41

where A is a formula and x, y are variables. The schema x = y ⊃ t(x) = t(y)

(ID= )

can be seen as a special case of ID (where A(z) ≡ t(x) = t(z)) combined with an appropriate instance of the axiom of reﬂexivity. More generally, we show that a single instance of ID is equivalent to some ﬁnite number of instances of ID= that involve the same pair of terms. (By an instance of a schema we mean a formula of the given form, where the variables have been replaced by terms.) Proposition 1. n (a) For every conjunction i=1 (s = t ⊃ ri (s) = ri (t)) of instances of ID= there is a tautological sequent Γ, s = t ⊃ (A(s) ⊃ A(t))

n

(s = t ⊃ ri (s) = ri (t))

i=1

where Γ consists of at most n instances of the reﬂexivity axiom and A ≤ 2n. (b) For every instance s = t ⊃ (A(s) ⊃ A(t)) of ID there is a tautological sequent Γ, s = t ⊃ r1 (s) = r1 (t), . . . , s = t ⊃ rn (s) = rn (t) s = t ⊃ (A(s) ⊃ A(t)) where Γ consists of instances of congruence axioms for predicate symbols and |Γ | ≤ a A , where a is the maximal arity of predicate symbols occurring in A. Proof. (a) Let A(t) =

n

(s = t ⊃ ri (s) = ri (t))

i=1

and A(s) =

n

(s = s ⊃ ri (s) = ri (s))

i=1

Let the instances Γ of the reﬂexivity axiom be r1 (s) = r1 (t), . . . , rn (s) = rn (t). Then one can easily derive the sequent Γ, s = t ⊃ (A(s) ⊃ A(t)) A(t), q.e.d. (b) Let r1 (s), . . . , rn (s) be all terms that occur as arguments of predicates (atoms) in A(s). Using appropriate instances of the congruence axioms we obtain a proof of Γ r1 (s) = r1 (t) ⊃ (. . . ⊃ (rn (s) = rn (t) ⊃ (A(s) ⊃ A(t)) . . .) R

where |Γ | is bounded by the number of argument positions in A, i.e., |Γ | ≤ a A , where a is the maximal arity of predicates occurring in A. Note that s = t ⊃ r1 (s) = r1 (t), . . . , s = t ⊃ rn (s) = rn (t), R s = t ⊃ (A(s) ⊃ A(t)) is tautological. Using the cut rule we thus obtain a proof of the sequent, as required.

42

M. Baaz and C.G. Ferm¨ uller

The following theorem (together with Propositions 2) shows that a single application of the schema of identity can replace an unbounded number of instances of identity axioms. (Remember that, by Proposition 1, the two instances of ID= correspond to a single instance of ID in presence of some additional instances of congruence axioms.) Theorem 1. Let A(u, x, y) ≡ ((x + y = y ⊃ x = 0) ∧ 0 + 0 = 0) ⊃ u = 0. (We refer to all positions at which the variables u, x, y occur.) For all p ∈ N there are terms r1p , r2p , tp1 , tp2 such that the sequent 0 + 0 = 0 ⊃ r1p (0 + 0) = r1p (0), 0 + 0 = 0 ⊃ r2p (0 + 0) = r2p (0), T A([0]p+ , tp1 , tp2 ) is tautological, where T is an instance of the transitivity axiom. Proof. Let

r1p (0 + 0) ≡ [0]p+ + ([0]p−1 + . . . + ([0]2+ + 0) . . .) +

where “(0 + 0)” in “r1p (0 + 0)” refers to all occurrences of subterms of this form. Let r2p (0 + 0) ≡ [0]p−1 + (. . . + ([0]2+ + (0 + 0) . . .) + where “(0 + 0)” in “r2p (0 + 0)” refers only to the rightmost (i.e., the underlined) occurrence of 0 + 0. Note that r2p (0 + 0) ≡ r1p (0). The needed instance T of the transitivity axiom is (r1p (0 + 0) = r1p (0) ∧ r2p (0 + 0) = r2p (0)) ⊃ r1p (0 + 0) = r2p (0). Let and

tp1 ≡ [0]p+ tp2 ≡ [0]p−1 + (. . . + ([0]2+ + 0) . . .). +

Note that tp2 ≡ r2p (0) and tp1 + tp2 ≡ r1 (0 + 0); tp1 is identical to the parameter term and the conclusion of the instance of the transitivity axiom is identical to instance of the premise in x + y = y ⊃ x = 0. Consequently the sequent is of form N ⊃ B1 , N ⊃ B2 , (B1 ∧ B2 ) ⊃ B ((B ⊃ C) ∧ N ) ⊃ C and therefore tautological.

Remark 1. A variant of this statement for number theory has been proven in [Yukami, T., 1984]. See also [Baaz, M. and Pudl´ ak, P., 1993]. Remark 2. Note that only few properties of “+” and “0” are used. In particular, one may think of “0” as the neutral element of an arbitrary group (w.r.t. +). From this observation it follows that the implication x + y = y ⊃ x = 0 can be replaced by pure identities in principle.

A Note on the Proof-Theoretic Strength of a Single Application

43

As mentioned above, each instance of the schema of identity is provable from identity axioms. However, the instances of ID= in the tautological sequent of Theorem 1 cannot be replaced by a number of instances of identity axioms that is independent of the “size” p of the parameter term [0]p+ , as the following proposition shows. Proposition 2. Let Γp ∆p be tautological, where Γp consists of instances of identity axioms, and ∆p consists of instances of A([0]p+ , x, y) (for A as in Theorem 1). |Γp | + |∆p | cannot be uniformly bounded by a constant. Proof. Indirect. Assume that there are constant numbers a and b such that for all p we have |Γp | = a and |∆p | = b. We look at a term minimal generalization of the sequent Γp ∆p . I.e., we replace the formulas in ∆p by formulas A(u, xi , yi ), where the xi , yi (1 ≤ i ≤ b) are pairwise distinct variables distinct also from u. Moreover, we replace each formula in Γp by a fresh copy of the identity axiom Ij of which it is an instance. The resulting sequent I1 , . . . , Ia A(u, x1 , y1 ), . . . , A(u, xb , yb ) is no longer tautological. However, by simultaneously unifying all those pairs of occurrences of atoms (s = t, s = t ) for which the corresponding atoms in Γp ∆p are identical, we regain a tautological sequent σ(I1 ), . . . σ(Ia ) A(σ(u), σ(x1 ), σ(y1 )), . . . , A(σ(u), σ(xb ), σ(yb )) where σ is the most general uniﬁer. This sequent is independent of p, but the term [0]p+ is an instance of σ(u). Therefore σ(u) must be of form 0 + (. . . (0 + z) . . .) where z is a variable. However, this implies that the sequent cannot be tautological. (Standard arithmetic provides a counter example.)

Remark 3. The above statement can be strengthened by allowing also instances of valid universal number theoretic formulas in Γp .

4

Monadic Parameter Terms

Looking at the formulation of Theorem 1 one might be seduced to believe that it is essential that the parameter term [0]p+ is built up using a binary function symbol. However an analogous fact also holds for monadic parameter terms: Theorem 2. Let A(u, x, y) ≡ (x + y = y ⊃ x = 0) ∧ f (x) = x) ⊃ u = 0). (We refer to all positions at which the variables u, x, y occur.) For all p ∈ N there are terms r1p , r2p , tp1 , tp2 such that the sequent f (0) = 0 ⊃ r1p (f (0)) = r1p (0), 0 + 0 = 0 ⊃ r2p (0 + 0) = r2p (0), T A(f p (0), tp1 , tp2 ) is tautological, where T is an instance of the transitivity axiom.

44

M. Baaz and C.G. Ferm¨ uller

Proof. Let Therefore and

r1p (z) ≡ f p−1 (z) + (. . . + (z + 0) . . .). r1p (f (0)) ≡ f p (0) + (. . . + (f (0) + 0) . . .) r1p (0) ≡ f p−1 (0) + (. . . + (0 + 0) . . .)

Note that this implies that also the leftmost formula of the sequent is an instance of ID= . Let r2p (z) ≡ f p−1 (0) + (. . . + (f (0) + z . . .)). Setting and

tp1 ≡ f p (0) tp2 ≡ f p−1 (0) + (. . . + (f (0) + 0) . . .)

it is straightforward to check that the sequent is tautological (analogously to the proof of Theorem 1.)

Remark 4. Note that in the proof above two instances of the schema of identity are used. (See also the ﬁnal remark, at the end of the paper.) Again, one can show that the two instances of ID= cannot be replaced by a uniformly bounded number of instances of identity axioms: Proposition 3. Let Γp ∆p be tautological, where Γp consists of instances of identity axioms and ∆p consists of instances of A(f p (0), x, y) (for A as in Theorem 2). |Γp | + |∆p | cannot be uniformly bounded by a constant. Proof. Analogous to the proof of Proposition 2.

5

Cases Where the Schema of Identity Is “Weak”

Deﬁnition 1. We call a unary function symbol s fanning out if there is a set of axioms NFPs such that for all m = n the formula sm (x) = sn (x) is provable from NFPs and the identity axioms. We show that — in contrast to the results in the last section — “short” proofs using one instance of the schema of identity can be transformed into “short” proofs using only identity axioms if the parameter term is composed of a fanning out function symbol.

A Note on the Proof-Theoretic Strength of a Single Application

45

Theorem 3. Let the propositional sequent (H id ) Ξ, s = t ⊃ r1 (s) = r1 (t), . . . , s = t ⊃ rk (s) = rk (t) A(sp (0), t1 ), . . . , A(sp (0), tn ) be provable in LK, where Ξ consists of instances of identity axioms, and k as well as |Ξ| are independent of the size p of the parameter term sp (0). If s is fanning out than the instances of ID= are redundant in the following sense: A sequent Ξ , Ω A(sp (0), t1 ), . . . , A(sp (0), tr )

(H ◦ )

is provable in LK, where r ≤ 2n, Ω is a (possibly empty) sequence of instances axioms in NFPs and Ξ is a sequence of instances of identity axioms and both |Ξ| and |Ω| are independent of the size p of the parameter term sp (0). Proof. Case 1: s ≡ t. In this case the instances of ID= in (H id ) clearly can be replaced by the instances r1 (s) = r1 (s), . . . , rk (s) = rk (s) of the reﬂexivity axiom to obtain the required Herbrand disjunction (H ◦ ). Case 2: s ≡ s 1 (0) and t ≡ s 2 (0), &1 = &2 . Since s = t s = t ⊃ ri (s) = ri (t) is a tautology we can transform the derivation of (H id ) into one of Ξ, s = t A(sp (0), t1 ), . . . , A(sp (0), tn )

(1)

By the form of s and t and the fact that s is fanning out s = t is derivable from NFPs and identity axioms. In other words, there exists a tautological sequent Ξ, Π A(sp (0), t1 ), . . . , A(sp (0), tn ) where Π consists of instances of axioms in NFPs and identity axioms. However, in general, the size of s and t will depend on the depth p of the parameter, which implies that |Π| is dependent on p as well. Therefore we transform sequent (1) into another tautological sequent Ξ , s = t A(sp (0), t1 ), . . . , A(sp (0), tn ) where the sizes of terms s and t are independent of p. To this end we replace in (1) all occurrences of sp (0) by a fresh variable u, all indicated occurrences of terms in t1 , . . . , tn by pairwise distinct and new variables, each formula in Ξ by a fresh copy of the identity axiom of which it is an instance, as well as s = t by v = w, where v, w are fresh variables as well. Of course, the resulting sequent Ξ ◦ , v = w A(u, x1 ), . . . , A(u, xn )

(2)

46

M. Baaz and C.G. Ferm¨ uller

is not tautological in general. However, by simultaneously unifying in (2) all those pairs of occurrences of atoms (P ◦ , Q◦ ) for which the corresponding atoms P and Q in (1) are identical, we regain a tautological sequent of form Ξ ∗ , sk1 (u1 ) = sk2 (u2 ) A(sk3 (z), t∗1 ), . . . , A(sk3 (z), t∗n )

(3)

where each of u1 , u2 and z is a either variable or the constant 0. Moreover, s is an instance of sk1 (u1 ), t an instance of sk2 (u2 ) and the parameter sp (0) an instance of sk3 (z). Observe that — if we use the most general uniﬁer to obtain (3) from (2) — k1 , k2 and k3 are independent of p. W.l.o.g. we assume that k1 ≤ k2 . We can also assume that z is a variable, since otherwise sk3 (z) ≡ sp (0) and therefore nothing is left to prove. To reconstruct the parameter at the appropriate places — i.e., to regain the required Herbrand disjunction of ∃x(A(sp (0), x)) at the right hand side of the sequent — we deﬁne a variable substitution σ that is to be applied to the whole sequent (3). Case 2.1: u1 ≡ z and u2 ≡ z. For i = 1, 2, if ui is a variable then set either σ(ui ) = 0 or σ(ui ) = s(0) in such a way that σ(sk1 (u1 )) ≡ σ(sk2 (u2 )). Case 2.2: u1 ≡ z and u2 ≡ z. σ remains empty. (Observe that in this case k1 = k2 ). Case 2.3: u1 ≡ z and u2 ≡ 0. We set σ(z) = sk2 −k1 +1 (z). Case 2.4: u1 ≡ z and u2 is a (diﬀerent) variable. We set σ(z) = sk2 −k1 +1 (u2 ). Case 2.5: u2 ≡ z and u1 ≡ 0. We set σ(z) = s(z). Case 2.6: u2 ≡ z and u1 is a (diﬀerent) variable. We set σ(z) = s(u1 ). Note that, in all cases, the depth of σ(sk1 (u1 ) = sk2 (u2 )) is independent of p. Moreover σ(sk1 (u1 )) ≡ σ(sk2 (u2 )) which implies that a sequent Σ σ(sk1 (u1 ) = sk2 (u2 ))

(4)

is derivable where Σ consists of a number of instances of axioms in NFPs and identity axioms that is independent of p. Using (4) and the result of applying σ to (3) we obtain

Σ A(sp (z), t1 ), . . . , A(sp (z), tn ) where Σ consists of instances from NFPs and identity axioms and |Σ| is independent from p. Since p ≤ p it remains to instantiate sp−p (0) for z to obtain the required Herbrand disjunction (H ◦ ). Case 3: Either s ≡ s (0) or t ≡ s (0) for some & ≥ 0. W.l.o.g., we assume t is not of this form. Since s = t s = t ⊃ r1 (s) = r1 (t), . . . , s = t ⊃ rk (s) = rk (t) is a tautological sequent also s = t, Ξ A(sp (0), t1 ), . . . , A(sp (0), tn )

(5)

A Note on the Proof-Theoretic Strength of a Single Application

47

is tautological. It thus remains to show that we can also derive a sequent s = t, Ξ A(sp (0), t1 ), . . . , A(sp (0), tn )

(6)

where Ξ consists of axiom instances and |Ξ | does not depend on p. We can then join (5) and (6) — by applying the cut rule — to derive the required Herbrand disjunction (H ◦ ) (which will have 2n disjuncts). Observe that possibly either s ≡ t[s] or t ≡ s[t]. However, w.l.o.g., we may assume that t ≡ s[t] (i.e., t does not occur in s, but possibly vice versa). We begin by replacing in (H id ) all occurrences of t by s. Since new occurrences of t might arise we repeat this step until no occurrences of t are left in the sequent. Let us denote the result by t∗ t∗ t∗ t∗ {Ξ}t∗ s , s = s ⊃ {r1 (s)}s = {r1 (t)}s , . . . , s = s ⊃ {rk (s)}s = {rk (t)}s

p t∗ {A(sp (0), t1 )}t∗ s , . . . , {A(s (0), tn )}s

t∗ = can be replaced by k inSince {r1 (s)}t∗ s ≡ {r1 (t)}s the instances of ID stances of the reﬂexivity axiom. We denote this sequence of k axiom instances by Ξ and obtain p t∗ p t∗ {Ξ}t∗ s , Ξ {A(s (0), t1 )}s , . . . , {A(s (0), tn )}s

(7)

Observe that although, by assumption, t is not of form s (0) it might properly contain the parameter sp (0) as subterm. Thus in (7) the parameter might have been replaced; moreover A(., .) ≡ {A(., .)}t∗ s in general. Similarly the iterated replacement of t by s might result in members of {Ξ}t∗ s that are not longer instances of identity axioms. It thus remains to reconstruct the required Herbrand disjunction relative to axioms by re-substituting t for some occurrences of s in (7). For this we have to use s = t. We can derive in LK any propositional sequent of form s = t, Π, B Bts

(8)

where Π consists of instances of identity axioms and Bts is like B except for replacing a single occurrence of s in B — say at position π in B — by t. Clearly, we can bound |Π| by |π|, i.e. the depth of the position π. By setting t∗ {A(sp (0), ti )}t∗ s or a formula in {Ξ}s for B and (repeatedly) applying the cut rule we can transform the derivation of (5) and derivations of appropriate instances of (6) into a derivation of p t∗ s = t, Ξ , Π A(sp (0), {t1 }t∗ s ), . . . , A(s (0), {tn }s )

(9)

where Ξ and Π consist of instances of identity axioms and |Ξ | = |Ξ|. Since we replaced only occurrences of s in positions that are already present in A(., .) and in the identity axioms, respectively, |Π | does not depend on the size of the parameter p. Therefore (9) is the sequent (6) that we have been looking for.

48

M. Baaz and C.G. Ferm¨ uller

The above proof is easily adapted to the case where the parameter is composed using a binary function symbol. Deﬁnition 2. We call a binary function symbol fanning out in presence of a n set of axioms NFP such that for all m = n the formula [x]m = [x] is provable from NFP and the identity axioms. Corollary 1. Let the propositional sequent Ξ, s = t ⊃ r1 (s) = r1 (t), . . . , s = t ⊃ rk (s) = rk (t) A([c]p , t1 ), . . . , A([c]p , tn ) by provable in LK, where Ξ consists of instances of identity axioms, and k as well as |Ξ| are independent of the size p of the parameter [c]p . If is fanning out then a sequent Ξ , Ω A([c]p , t1 ), . . . , A([c]p , tr ) is provable in LK, where r ≤ 2n, Ω is a (possibly empty) sequence of instances of the axioms NFP and Ξ is a sequence of instances of identity axioms and both |Ξ| and |Ω| are independent of the size p of the parameter.

6

Final Remark

Two instances of the schema of identity (ID) are necessary indeed to obtain the “short proofs” of Theorem 2. This is because in presence of arbitrary instances of s(x) = x the condition of “fanning out” in Theorem 3 can be replaced by the following: For every term s and every n there are terms t1 , . . . , tn such that s = ti and ti = tj is provable for all i, j ∈ {1, . . . , n}, i = j.

References [Baaz, M. and Leitsch, A., 1994] On Skolemization and Proof Complexity. Fundamenta Informaticae 20(4), pages 353–379. [Baaz, M. and Leitsch, A., 1999] Cut normal forms and proof complexity. Ann. Pure Appl. Logic 97(1-3), pages 127–177. [Baaz, M. and Pudl´ ak, P., 1993] Kreisel’s conjecture for L∃1 . In P. Clote and J. Kraj´ıˇcek, editors, Arithmetic, Proof Theory and Computational Complexity, pages 29–59. Oxford University Press, 1993. With a postscript by G. Kreisel. [Leitsch, A., 1997] The Resolution Calculus. Springer-Verlag, Berlin, Heidelberg, New York. [Takeuti, G., 1980] Proof Theory. North-Holland, Amsterdam, 2nd edition. [Yukami, T., 1984] Some results on speed-up. Ann. Japan Assoc. Philos. Sci., 6, pages 195–205.

Comparing the Complexity of Cut-Elimination Methods Matthias Baaz1 and Alexander Leitsch2 1

Institut f¨ ur Computermathematik (E-118), TU-Vienna, Wiedner Hauptstraße 8-10, 1040 Vienna, Austria [email protected] 2 Institut f¨ ur Computersprachen (E-185), TU-Vienna, Favoritenstraße 9, 1040 Vienna, Austria [email protected]

Abstract. We investigate the relative complexity of two diﬀerent methods of cut-elimination in classical ﬁrst-order logic, namely the methods of Gentzen and Tait. We show that the methods are incomparable, in the sense that both can give a nonelementary speed-up of the other one. More precisely we construct two diﬀerent sequences of LK-proofs with cuts where cut-elimination for one method is elementary and nonelementary for the other one. Moreover we show that there is also a nonelementary diﬀerence in complexity for diﬀerent deterministic versions of Gentzen’s method.

1

Introduction

Gentzen’s fundamental paper introduced cut-elimination as a fundamental procedure to extract proof theoretic information from given derivations such as Herbrand’s Theorem, called Mid-Sequent Theorem in this context. In traditional proof theory, the general possibility to extract such informations is stressed, but there is less interest in applying the procedures in concrete cases. This, however, becomes essential if proof theory is considered as a basis for an automated analysis of proofs, which becomes important in connection with the development of eﬀective program solving software for mathematical applications such as MATHEMATICA. In this paper we compare the two most prominent cut-elimination procedures for classical logic: Gentzen’s procedure and Tait’s procedure; we avoid to call them ”algorithms” because of their highly indeterministic aspects. From a procedural point of view, they are characterized by their diﬀerent cut-selection rule: Gentzen’s procedure selects a highest cut, while Tait’s procedure selects a largest one (w.r.t. the number of connectives and quantiﬁers). The most important logical feature of Gentzen’s procedure is, that – contrary to Tait’s method – it transforms intuitionistic proofs into intuitionistic proofs (within LK) and there is no possibility to take into account classical logic when intended. Tait’s R. Kahle, P. Schroeder-Heister, and R. St¨ ark (Eds.): PTCS 2001, LNCS 2183, pp. 49–67, 2001. c Springer-Verlag Berlin Heidelberg 2001

50

M. Baaz and A. Leitsch

procedure, on the other hand, does not change the inner connections of the derivation, it replaces cuts by smaller ones without reordering them. In this paper, we use the sequence γn of LK-proofs corresponding to Statman’s worst-case sequence to compare Gentzen’s and Tait’s procedure. The sequence γn is transformed twice: ﬁrst into a sequence ψn where Tait’s method speeds up Gentzen’s nonelementarily, and second into a sequence φn giving the converse eﬀect. As a complexity measure we take the total number of symbol ocurrences in reduction sequences of cut-elimination (i.e. all symbol occurrences in all proofs occurring during the cut-elimination procedure are measured). Both methods are nondeterministic in nature. But also diﬀerent deterministic versions of one and the same method may diﬀer quite strongly: we show that even two different deterministic versions of Gentzen’s method diﬀer nonelementarily (w.r.t. the total lengths of the corresponding reduction sequences). Finally we would like to emphasize that the main goal of this paper is to give a comparison of diﬀerent cut-elimination methods. It is not our intention to investigate, at the same time, the eﬃciency of calculi; for this reason we do not work with improved or computationally optimized versions of LK, but rather take a version of LK which is quite close to the original one.

2

Deﬁnitions and Notation

Deﬁnition 1 (complexity of formulas). If F is a formula in PL then the complexity comp(F ) is the number of logical symbols occurring in F . Formally we deﬁne comp(F ) = 0 if F is an atom formula, comp(F ) = 1 + comp(A) + comp(B) if F ≡ A ◦ B for ◦ ∈ {∧, ∨, →}, comp(F ) = 1 + comp(A) if F ≡ ¬A or F ≡ (Qx)A for Q ∈ {∀, ∃}. Deﬁnition 2 (sequent). A sequent is an expression of the form Γ ∆ where Γ and ∆ are ﬁnite multisets of PL-formulas (i.e. two sequents Γ1 ∆1 and Γ2 ∆2 are considered equal if the multisets represented by Γ1 and by Γ2 are equal and those represented by ∆1 , ∆2 are also equal). Deﬁnition 3 (the calculus LK). The initial sequents are A A for PLformulas A. In the rules of LK we always mark the auxiliary formulas (i.e. the formulas in the premis(ses) used for the inference) and the principal (i.e. the infered) formula using diﬀerent marking symbols. Thus, in our deﬁnition, ∧-introduction to the right takes the form Γ 1 A+ , ∆ Γ2 ∆ 2 , B + Γ 1 , Γ2 ∆ 1 , A ∧ B ∗ , ∆ 2 We usually avoid markings by putting the auxiliary formulas at the leftmost position in the antecedent of sequents and in the rightmost position in the consequent of sequents. The principal formula mostly is identiﬁable by the context.

Comparing the Complexity of Cut-Elimination Methods

51

Thus the rule above will be written as Γ2 ∆2 , B Γ1 ∆1 , A Γ 1 , Γ2 ∆ 1 , ∆ 2 , A ∧ B Unlike Gentzen’s version of LK (see [5]) ours does not contain any “automatic” contractions (in this paper we do not consider intuitionistic logic). Instead we use the additive version of LK as in the book of Girard [6], combined with multiset structure for the sequents (this is exactly the version of LK used in [3]) By the deﬁnition of sequents over multisets we don’t need the exchange rules. In our notation Γ, ∆, Π and Λ serve as metavariables for multisets of formulas; is the separation symbol. For a complete list of the rules we refer to [3]; we only give three logical and three structural rules here. – The logical rule ∨-introduction left: A, Γ ∆ B, Π Λ ∨:l A ∨ B, Γ, Π ∆, Λ – The logical rules for ∨-introduction right: Γ ∆, A ∨ : r1 Γ ∆, A ∨ B Γ ∆, B ∨ : r2 Γ ∆, A ∨ B – The structural rules weakening left and right: Γ ∆ w:r Γ ∆, A – The cut rule:

Γ ∆ w:l A, Γ ∆

Γ ∆, A A, Π Λ cut Γ, Π ∆, Λ

An LK-derivation is deﬁned as a directed tree where the nodes are occurrences of sequents and the edges are deﬁned according to the rule applications in LK. Let A be the set of sequents occurring at the leaf nodes of an LK-derivation ψ and S be the sequent occurring at the root (called the end-sequent). Then we say that ψ is an LK-derivation of S from A (notation A LK S). If A is a set of initial sequents then we call ψ an LK-proof of S. Note that, in general, cut-elimination is only possible in LK-proofs. We write (ψ) S to express that ψ is a proof with end sequent S. Paths in an LK-derivation ψ, connecting sequent occurrences in ψ, are deﬁned in the traditional way; a branch in ψ is a path starting in the end sequent.

52

M. Baaz and A. Leitsch

We use the terms “predecessor” and “successor” in the intuitive sense (i.e. contrary to the direction of edges in the tree): If there exists a path from S1 to S2 then S2 is called a predecessor of S1 . The successor relation is deﬁned in a analogous way. E.g. every initial sequent is a predecessor of the end sequent. Deﬁnition 4. The length of a proof ω is deﬁned by the number of symbol occurrences in ω and is denoted by l(ω). The famous proof of the cut-elimination property of LK is based on a double induction on rank and grade of a modiﬁed form of cut, namely the mix. Deﬁnition 5 (mix). Let Γ Π and ∆ Λ two sequents and A be a formula which occurs in Π and in ∆; let Π ∗ , ∆∗ be Π, ∆ without occurrences of A. Then the rule Γ Π ∆ Λ mix Γ, ∆∗ Π ∗ , Λ is called a mix on A. Frequently we label the rule by mix(A) to indicate that the mix is on A. Deﬁnition 6. Let φ be an LK-proof and ψ be a subderivation of the form (ψ1 ) (ψ2 ) Γ1 ∆1 Γ2 ∆2 mix (A) Γ1 , Γ2∗ ∆∗1 , ∆2 Then we call ψ a mix-derivation in φ; if the mix is a cut we speak about a cut-derivation. We deﬁne the grade of ψ as comp(A); the left-rank of ψ is the maximal number of nodes in a branch in ψ1 s.t. A occurs in the consequent of a predecessor of Γ1 ∆1 . If A is ”produced” in the last inference of ψ1 then the left-rank of ψ is 1. The right-rank is deﬁned in an analogous way. The rank of ψ is the sum of right-rank and left-rank. The cut-elimination method of Gentzen can be formalized as a reduction method consisting of rank- and grade reductions on LK-proofs. But also Tait’s method can be deﬁned in this way, but with another selection of a cut-derivation in the proof. In a slight abuse of language we speak about cut-reduction, even if the cuts are actually mixes. Deﬁnition 7 (cut-reduction rule). In Gentzen’s proof a mix-derivation ψ is selected in an LK-proof φ and replaced by a derivation ψ (with the same endsequent) s.t. the corresponding mix-derivation(s) in ψ has either lower grade or lower rank than ψ. These replacements can be interpreted as a reduction relation on LK-proofs. Following the lines of Gentzen’s proof of the cut-elimination property in [5] we give a formal deﬁnition of the relation > on LK-proofs in the Appendix. Using > we can deﬁne two proof reduction relations, >G for Gentzen reduction and >T for Tait reduction. Let φ be a proof and let ψ be a mix-derivation in φ occurring at position λ (we write φ = φ[ψ]λ ); assume that ψ > ψ .

Comparing the Complexity of Cut-Elimination Methods

53

If λ is an occurrence of an uppermost mix in φ then we deﬁne φ[ψ]λ >G φ[ψ ]λ . If λ is an occurrence of a mix with maximal grade in φ then we deﬁne φ[ψ]λ >T φ[ψ ]λ .

Deﬁnition 8 (cut-reduction sequence). Let >x be one of the reduction relations >T , >G and φ be an LK-proof. Then a sequence η : φ1 , . . . , φn is called a cut-reduction sequence on φ w.r.t. >x if the following conditions are fulﬁlled – φ1 = φ and – φk >x φk+1 for k = 1, ..n − 1. If φn is cut-free then η is called a cut-elimination sequence on φ w.r.t. >x . Note that >G is more liberal than the direct intepretation of Gentzen’s induction proof as a nondeterministic algorithm. But in the speed-up by Gentzen’s over Tait’s procedure we use the ”traditional” Gentzen procedure (where one uppermost cut is eliminated before other uppermost cuts are transformed); this makes our results even stronger. >T had to be adapted anyway, as the calculus in Tait’s paper [9] is not LK. Deﬁnition 9. Let e : IN2 → IN be the following function e(0, m) = m e(n + 1, m) = 2e(n,m) . A function f : INk → INm for k, m ≥ 1 is called elementary if there exists an n ∈ IN and a Turing machine T computing f s.t. the computing time of T on input (l1 , . . . , ln ) is less or equal e(n, |(l1 , . . . , lk )|) where | | denotes the maximum norm on INk . The function s : IN → IN is deﬁned as s(n) = e(n, 1) for n ∈ IN. Note that the functions e and s are nonelementary. Deﬁnition 10 (NE-improvement). Let η be a cut-elimination sequence. We denote by η the number of all symbol occurrences in η (i.e. the symbolic length of η). Let >x and >y be two cut-reduction relations (e.g. >T and >G ). We say that >x NE-improves >y (NE stands for nonelementarily) if there exists a sequence of LK-proofs (γn )n∈IN with the following properties: 1. There exists an elementary function f s.t. for all n there exists a cutelimination sequence ηn on γn w.r.t. >x with ηn < f (n), 2. For all elementary functions g there exists an m ∈ IN s.t. for all n with n > m and for all cut-elimination sequences θ on γn w.r.t. >y : θ > g(n).

54

3

M. Baaz and A. Leitsch

The Proof Sequence of R. Statman

In [8] Richard Statman proved the remarkable result, that there are sequences of formulas having short proofs, but a nonelementarily increasing Herbrand complexity. More formally, there exists a sequence (Sn )n∈IN of sequents having LKproofs (γn )n∈IN with l(γn ) ≤ n2an for some constant a, but the Herbrand complexity of Sn is > s(n)/2 (see Deﬁnition 9). As Sn consists of prenex formulas (in fact of universal closures), Herbrand complexity is a lower bound on the length of a cut-free proof. Putting things together we obtain a sequence (γn )n∈IN of LK-proofs of (Sn )n∈IN with the following properties: – There exist a constant a with l(γn ) ≤ n2an , – for all cut-free proofs ψ of Sn l(ψ) > 12 s(n). This yields that every method of cut-elimination on (γn )n∈IN must be of nonelementary expense. Our aim is to use γn in constructing new proofs φn in which the γn are in some sense ”redundant”; this redundancy may be ”detected” by one cut-elimination method (behaving elementarily on φn ), but not by the other one (having thus nonelementary expense on φn ). For his result on Herbrand complexity Statman deﬁnes a sequence of problems in combinatory logic (expressing iterated exponentiation) together with an elegant sequence of short proofs. The detailed formalization of the short proofs in LK can be found in [1]. What we need here is the overall structure of the proofs γn , in particular the positions of the cuts; on the other hand we do not need atomic initial sequents like in [1]. The sequence Sn is of the form ∆n Dn where ∆n consists of a ﬁxed sequence of closed equations + a linear number of equality axioms of at most exponential length. Instances of the formulas Hi deﬁned below form the cut formulas in γn , where p is a constant symbol: H1 (y) ≡ (∀x1 )px1 = p(yx1 ), Hi+1 (y) ≡ (∀xi+1 )(Hi (xi+1 ) → Hi (yxi+1 )). From the deﬁnition of the Hi it is easy to derive l(Hi ) ≤ 2bi for all i and some constant b; moreover comp(Hi ) < 2i+1 . The sequence γn is of the form (χ1 ) H2 (Tn ), H1 (q) H1 (Tn q) cut H1 (q) H1 (q) Γ2n+1 , H1 (q) H1 (Tn q) cut ∆n H1 (Tn q) δn

where δn is (ψ2 ) Γ2n−1 H2 (T)

(δn−1 ) Γ2(n−1) H3 (Tn−1 )

(χ2 ) H3 (Tn−1 ), H2 (T) H2 (Tn )

Γ2(n−1) , H2 (T) H2 (Tn ) Γ2n H2 (Tn )

cut

cut

Comparing the Complexity of Cut-Elimination Methods

55

T is a combinator deﬁned from the basic combinators S, B, C, I by T ≡ (SB)((CB)I) and Ti+1 = Ti T; T fulﬁls the equation (Ty)x = y(yx). q is a constant symbol and Γ1 , Γ2 , Γ3 are subsequences of ∆n . For details we refer to [1]. The proofs ψi and χi are cutfree proofs with a ﬁxed number of sequents; their length, however, is exponential as the formulas Hi grow in size exponentially. The cuts are hierarchically located in a linear structure: there is only one uppermost cut, i.e. all cuts occur below this cut; every cut has all other cuts as his predecessor or as his successor. We give some informal description of the proofs ψi and χi , for greater detail we refer to [1]. First we describe the proof ψi+2 for i ≥ 1; the case ψ2 is quite similar. By deﬁnition of the formulas Hi we have to show (∀xi+2 )(Hi+1 (xi+2 ) → Hi+1 (Txi+2 )). Using the deﬁnition of Hi+1 (y) for some variable y we ﬁrst prove (in a ﬁxed number of steps) from Hi+1 (y) that (∀xi+1 )(Hi (xi+1 ) → Hi (y(yxi+1 ))) holds. Then use an equational proof of y(yxi+1 ) = (Ty)xi+1 and insert it into the consequent of the upper implication via appropriate equational axioms. This way we obtain the formula (∀xi+1 )(Hi (xi+1 ) → Hi ((Ty)xi+1 )) which is just Hi+1 (T y). So we have a derivation of Hi+1 (y) → Hi+1 (Ty). By using y as eigenvariable and applying ∀-introduction we obtain (∀xi+2 )(Hi+1 (xi+2 ) → Hi+1 (Txi+2 )) which is Hi+2 (T). This eventually gives the proof ψi+2 . The proofs χi : We prove the sequent Hi+1 (Tn−i+1 ), Hi (T) Hi (Tn−i+2 ) by

Hi (T) Hi (T) Hi (Tn−i+2 ) Hi (Tn−i+2 ) →: l Hi (T) → Hi (Tn−i+2 ), Hi (T) Hi (Tn−i+2 ) ∀:l (∀xi+1 )(Hi (xi+1 ) → Hi (Tn−i+1 xi+1 )), Hi (T) Hi (Tn−i+2 )

which consists of 4 sequents only; the length of χi is exponential in i. Roughly described, the elimination of the uppermost cut is only exponential and the elimination of a further cut below increases the degree of exponentiation. As there are linearly many cut formulas H1 (q), H2 (T), . . . , Hn+2 (T) and Hn (T2 ), . . . , H2 (Tn ) the resulting total expense is nonelementary.

56

4

M. Baaz and A. Leitsch

Comparing the Methods of Gentzen and Tait

Our ﬁrst result expresses the fact that a cut-elimination method selecting maximal cuts can be nonelementarily faster than methods selecting an uppermost cut. Theorem 1. Tait’s method can give a nonelementary speed-up of Gentzen’s method or more formally: >T NE-improves >G . Proof. Let γn be Statman’s sequence deﬁned in Section 3. We know that the maximal complexity of cut formulas in γn is less than 2n+3 . Let g(n) = 2n+3 and the formulas Ai be deﬁned as A0 = A for an atom formula A Ai+1 = ¬Ai for i ∈ IN. For every n ∈ IN we set En ≡ Ag(n) . Then clearly comp(En ) = g(n) and thus is greater than the cut-complexity of γn . We will build En into a more complex formula, making this formula the main formula of a cut. For every n ∈ IN let ψn be the LK-proof: En En A A (γn ) →: l En → A, En A En En ∆n Dn ∧:r ∧:l En , ∆n Dn ∧ En Dn ∧ En , En → A A cut En , ∆n , En → A A By deﬁnition of γn the proofs γn and ψn contain only a linear number of sequents, where the size of each sequent is less or equal than n2cn for some constant independent of n. Consequently there exists a constant d s.t. l(ψn ) ≤ n2 2dn for all n. We now construct a cut-elimination sequence on ψn based on Tait’s cutreduction >T . As comp(En ) is greater than the cut-complexity of γn , and comp(Dn ∧ En ) > comp(En ), the most complex cut formula in ψn is Dn ∧ En . This formula is selected by Tait’s method and we obtain ψn >T ψn (via rule 3.113.31 in the appendix) for the proof ψn below En En A A →: l En En En , En → A A cut En , En → A A w : l∗ En , ∆n , En → A A ψn contains only one single cut with cut formula En . Now the left hand side of the cut consists of an atomic sequent only making rule 3.111. applicable. Moreover the cut with formula En is the only one in ψn . So reduction can be applied via >T and we obtain ψn >T ψn for ψn : En En A A →: l En , En → A A w : l∗ En , ∆n , En → A A

Comparing the Complexity of Cut-Elimination Methods

57

Therefore ηn : ψn , ψn , ψn is a cut-elimination sequence based on >T . It is easy to see that the lengths of the proofs decrease in every reduction step. So we obtain ηn ≤ n2 2dn+2 . In the second part of the proof we show that every cut-elimination sequence on ψn based on the relation >G is of nonelementary length in n. Note that every cut in γn lies above the cut with cut formula Dn ∧ En . Therefore, in Gentzen’s method, we have to eliminate all cuts in γn before eliminating the cut with Dn ∧ En . So every cut-elimination sequence on ψn based on >G must contain a proof of the form En En A A (γn∗ ) →: l En → A, En A En En ∆n Dn ∧:r ∧:l Dn ∧ En , En → A A En , ∆n Dn ∧ En cut En , ∆n , En → A A where γn∗ is a cut-free proof of ∆n Dn . But according to Statman’s result we ∗ have l(γn∗ ) > s(n) 2 . Clearly the length of γn is a lower bound on the length of every cut-elimination sequence on ψn based on >G . Thus for all cut-elimination sequences θ on ψn w.r.t. >G we obtain θ >

s(n) . 2 ✸

A nonelementary speed-up is possible also the other way around. In this case it is an advantage to select the cuts from upwards instead by formula complexity. Theorem 2. Gentzen’s method can give a nonelementary speed-up of Tait’s method or more formally: >G NE-improves >T . Proof. Consider Statman’s sequence γn deﬁned in Section 3. Locate the uppermost proof δ1 in γn ; note that δ1 is identical to ψn+1 . In γn we ﬁrst replace the proof δ1 (or ψn+1 ) of Γn+1 Hn+1 (T) by the proof δˆ1 below: (ψn+1 ) (ω) Γ Hn+1 (T) 1 P ∧ ¬P w:r w:l P ∧ ¬P Q Q, Γ1 Hn+1 (T) cut P ∧ ¬P, Γ1 Hn+1 (T) The subproof ω is a proof of P ∧ ¬P of constant length. Furthermore we use the same inductive deﬁnition in deﬁning δˆk as that of δk in Section 3. Finally we obtain a proof φn in place of γn . Note that φn diﬀers from γn only by an additional (atomic) cut and the formula P ∧ ¬P in the antecedents of sequents. Clearly l(φn ) ≤ l(γn ) + cn for some constant c.

58

M. Baaz and A. Leitsch

Our aim is to deﬁne a cut-elimination sequence on φn w.r.t. >G which is of elementary complexity. Let Sk be the end sequent of the proof δˆk . We ﬁrst investigate cut-elimination on the proof δˆn ; the remaining two cuts are eliminated in a similar way. To this aim we prove by induction on k: (∗) There exists a cut-elimination sequence δˆk,1 , . . . , δˆk,m of δˆk w.r.t. >G with the following properties: (1) m ≤ l(δˆk ), (2) l(δˆk,i ) ≤ l(δˆk ) for i = 1, . . . , m, (3) δˆk,m is of the form (ω) P ∧ ¬P w :∗ Sk Induction basis k = 1: In δˆ1 there is only one cut (with the formula Q) where the cut formula is introduced by weakening. Thus by deﬁnition of >G , using the rule 3.113.1, we get δˆ1 >G δˆ1,2 where δˆ1,2 is the proof (ω) P ∧ ¬P w :∗ P ∧ ¬P, Γn+1 Hn+1 (T) Clearly 2 ≤ l(δˆ1 ) and l(δˆ1,2 ) ≤ l(δˆ1 ). Moreover δˆ1,2 is of the form (3). This gives (∗) for k = 1. (IH) Assume that (∗) holds for k. By deﬁnition, δˆk+1 is of the form (ψn−k+1 ) Γ2k+1 Hn−k+1 (T) ρk cut P ∧ ¬P, Γ2(k+1) Hn−k+1 (Tk+1 ) for ρk : (δˆk ) (χn−k+1 ) P ∧ ¬P, Γ2k Hn−k+2 (Tk ) Hn−k+2 (Tk ), Hn−k+1 (T) Hn−k+1 (Tk+1 ) cut P ∧ ¬P, Γ2k , Hn−k+1 (T) Hn−k+1 (Tk+1 ) By (IH) there exists a cut-elimination sequence δˆk,1 , . . . , δˆk,m on δˆk w.r.t. >G fulﬁlling (1), (2) and (3). In particular we have l(δˆk,m ) ≤ l(δˆk ) and δˆk,m is of the form (ω) P ∧ ¬P w :∗ Sk All formulas in Sk , except P ∧ ¬P , are introduced by weakening in δˆk,m . In particular this holds for the formula Hn−k+2 (Tk ) which is a cut formula in

Comparing the Complexity of Cut-Elimination Methods

59

δˆk+1 . After cut-elimination on δˆk the proof ρk is transformed (via >G ) into a proof ρˆk : (δˆk,m ) (χn−k+1 ) P ∧ ¬P, Γ2k Hn−k+2 (Tk ) Hn−k+2 (Tk ), Hn−k+1 (T) Hn−k+1 (Tk+1 ) cut P ∧ ¬P, Γ2k , Hn−k+1 (T) Hn−k+1 (Tk+1 ) Now the (only) cut in ρˆk is with the cut formula Hn−k+2 (Tk ) which is introduced by w : r in δˆk,m . By using iterated reduction of left-rank via the symmetric versions of 3.121.21 and 3.121.22 in the appendix, the cut is eliminated and the proof χn−k+1 ”disappears” and the result is again of the form (ω) P ∧ ¬P w :∗ P ∧ ¬P, Γ2k , Hn−k+1 (T) Hn−k+1 (Tk+1 ) The proof above is the result of a cut-elimination sequence ρˆk,1 , . . . , ρˆk,p on ρˆk w.r.t. >G . But then also δk+1 is further reduced to a proof where ρˆk is replaced by ρˆk,p ; in this proof there is only one cut left (with the formula Hn−k+1 (T) and we may play the ”weakening game” once more. Finally we obtain a proof δˆk,r of the form (ω) P ∧ ¬P w :∗ P ∧ ¬P, Γ2(k+1) Hn−k+1 (Tk+1 ) The conditions (1) and (2) are obviously fulﬁlled. This eventually gives (∗). After the reduction of φn to φn [δˆn,s ]λ , where λ is the position of δˆn and δˆn,s is the result of a Gentzen cut-elimination sequence on δˆn , there are only two cuts left. Again these cuts are swallowed by the proofs beginning with ω and followed by a sequence of weakenings. Putting things together we obtain a cut-elimination sequence ηn : φn,1 , . . . , φn,q on φn w.r.t. >G with the properties: (1) l(φn,i ) ≤ l(φn ) and (2) q ≤ l(φn ). But then

ηn ≤ l(φn )2 ≤ n4 2cn .

for an appropriate constant c. Therefore ηn is a Gentzen cut-elimination sequence on φn of elementary complexity. For the other direction consider Tait’s reduction method on the sequence φn . The cut formulas in φn fall into two categories; – the new cut formula Q with comp(Q) = 0 and – the old cut formulas from γn .

60

M. Baaz and A. Leitsch

Now let η be an arbitrary cut-elimination sequence on φn w.r.t. >T . By deﬁnition of >T only cuts with maximal cut formulas can be selected in a reduction step w.r.t. >T . Therefore, there exists a constant k s.t. k ≥ 1 and η contains a proof ψ with cut-complexity k. As the new cut in φn with cut formula Q is of complexity 0, it is still present in ψ. A straightforward proof transformation gives a proof χ s.t. γn >∗T χ, the cut-complexity of χ is k, and l(χ) < l(ψ) (in some sense the Tait procedure does not ”notice” the new atomic cut). But every cut-free proof of γn has a length > s(n) 2 and cut-elimination of cuts with (ﬁxed) complexity k is elementary [7]. More precisely there exists an elementary function f and a cut-elimination sequence θ on χ w.r.t. >T s.t. θ ≤ f (l(χ)). This is only possible if there is no elementary bound on l(χ) in terms of n (otherwise we would get cut-free proofs of γn of length elementarily in n). But then there is no elementary bound on l(ψ) in terms of n. Putting things together we obtain that for every elementary function f and for every cut-elimination sequence η on φn η > f (n) almost everywhere . ✸ Theorem 2 shows that there exist cut elimination sequences ηn on φn w.r.t. >G s.t. ηn is elementarily bounded in n; however this does not mean that every cut-elimination sequence on φn w.r.t. >G is elementary. In fact >G is highly ”unstable” in its diﬀerent deterministic versions. Consider the subproof δˆ1 in the proof of Theorem 2: (ψn+1 ) (ω) Γ Hn+1 (T) n+1 P ∧ ¬P w:r w:l P ∧ ¬P Q Q, Γn+1 Hn+1 (T) cut P ∧ ¬P, Γn+1 Hn+1 (T) If, in >G , we focus on the weakening (w : l) in the right part of the cut and apply rule 3.113.2 (appendix) we obtain δˆ1 >G µ, where µ is the proof (ψn+1 ) Γn+1 Hn+1 (T) w:l P ∧ ¬P, Γn+1 Hn+1 (T) But µ contains the whole proof ψn+1 . In the course of cut-elimination ψn+1 is built into the produced proofs exactly as in the cut-elimination procedure on γn itself. The resulting cut-free proof is in fact longer than γn∗ (the corresponding cut-free proof of the n-th element of Statman’s sequence) and thus is of nonelementary length! This tells us that there are diﬀerent deterministic versions α1 and α2 of >G s.t. α1 gives a nonelementary speed-up of α2 on the input set (φn )n∈IN . In the introduction of additional cuts into Statman’s proof sequence we use the weakening rule. Similar constructions can be carried out in versions of the

Comparing the Complexity of Cut-Elimination Methods

61

Gentzen calculus without weakening. What we need is just a sequence of short LK-proofs of valid sequents containing ”simple” redundant (in our case atomic) formulas on both sides serving as cut formulas. Note that LK without any redundancy (working with minimally valid sequents only) is not complete.

5

Conclusion

The main results of this paper hint to a more general theory of algorithmic cut elimination encompassing not only algorithmic speciﬁcations of Gentzen’s and Tait’s procedures but also approaches as cut projection [2] and the resolution based method CERES [4] . From a more proof theoretic point of view, the sequences of proofs arising from the diﬀerent stages of cut-elimination can be considered as a speciﬁc analysis of the proof which extends the information obtainable from the cut-free ﬁnal stage. Diﬀerent cut-elimination algorithms stress diﬀerent aspects of the proof, e.g. constructive content (Gentzen’s procedure) or connectivity (Tait’s procedure).

References 1. M. Baaz, A. Leitsch: On skolemization and proof complexity, Fundamenta Informaticae, 20(4), pp. 353–379, 1994. 2. M. Baaz, A. Leitsch: Fast Cut-Elimination by Projection, Proc. CSL’96, Lecture Notes in Computer Science 1258, pp. 18–33, Springer, Berlin, 1997. 3. M. Baaz, A. Leitsch: Cut normal forms and proof complexity, Annals of Pure and Applied Logic, 97, pp. 127-177, 1999. 4. M. Baaz, A. Leitsch: Cut-Elimination and Redundancy-Elimination by Resolution, Journal of Symbolic Computation, 29, pp. 149-176, 2000. 5. G. Gentzen: Untersuchungen u ¨ ber das logische Schließen, Mathematische Zeitschrift 39, pp. 405–431, 1934–1935. 6. J.Y. Girard: Proof Theory and Logical Complexity, in Studies in Proof Theory, Bibliopolis, Napoli, 1987. 7. H. Schwichtenberg: Proof Theory: Some Applications of Cut-Elimination, in Handbook of Mathematical Logic, ed. by J. Barwise, North Holland, Amsterdam, pp. 867–895, 1989. 8. R. Statman: Lower bounds on Herbrand’s theorem, in Proc. of the Amer. Math. Soc. 75, pp. 104–107, 1979. 9. W.W. Tait: Normal derivability in classical logic, in The Syntax and Semantics of Inﬁnitary Languages, ed. by J. Barwise, Springer, Berlin, pp. 204–236, 1968. 10. G. Takeuti: Proof Theory, North-Holland, Amsterdam, 2nd edition, 1987.

Appendix Below we list the transformation rules used in Gentzen’s proof of cut-elimination in [5]. Thereby we use the same numbers for labelling the subcases. Note that our rules slightly diﬀer from that of Gentzen as we use the purely additive version of LK. If a mix-derivation ψ is transformed to ψ then we deﬁne ψ > ψ ; remember

62

M. Baaz and A. Leitsch

that the relation > is the crucial tool in deﬁning Gentzen- and Tait reduction. In all reductions below ψ is a mix-derivation of the form (ψ2 ) (ψ1 ) Γ1 ∆1 Γ2 ∆2 mix Γ1 , Γ2∗ ∆∗1 , ∆2 3.11. rank = 2. 3.111. ψ1 = A A:

transforms to

(ψ2 ) A A ∆ Λ mix (A) A, ∆∗ Λ (ψ2 ) ∆ Λ c : l∗ A, ∆∗ Λ

3.112. ψ2 = A A: analogous to 3.111. 3.113.1. the last inference in ψ1 is w : r: (χ1 ) Γ ∆ w : r (ψ2 ) Π Λ Γ ∆, A mix (A) Γ, Π ∗ ∆, Λ transforms to

(χ1 ) Γ ∆ w : l∗ Γ, Π ∗ ∆, Λ

3.113.2. the last inference in ψ2 is w : l: symmetric to 3.113.1. The last inferences in ψ1 , ψ2 are logical ones and the mix-formula is the principal formula of these inferences: 3.113.31. (χ3 ) (χ1 ) (χ2 ) Γ1 Θ1 , A Γ2 Θ2 , B A, Γ3 Θ3 ∧:r ∧:l Γ1 , Γ2 Θ1 , Θ2 , A ∧ B A ∧ B, Γ3 Θ3 mix (A ∧ B) Γ1 , Γ2 , Γ3 Θ1 , Θ2 , Θ3 transforms to

(χ1 ) (χ3 ) Γ1 Θ1 , A A, Γ3 Θ3 mix (A) Γ1 , Γ3∗ Θ1∗ , Θ3 w :∗ Γ1 , Γ2 , Γ3 Θ1 , Θ2 , Θ3

For the other form of ∧ : l the transformation is straightforward. 3.113.32. The last inferences of ψ1 , ψ2 are ∨ : r, ∨ : l: symmetric to 3.113.31.

Comparing the Complexity of Cut-Elimination Methods

3.113.33. (χ1 [α]) (χ2 ) Γ1 Θ1 , Bαx Btx , Γ2 Θ2 ∀:r ∀:l Γ1 Θ1 , (∀x)B (∀x)B, Γ2 Θ2 mix ((∀x)B) Γ1 , Γ2 Θ1 , Θ2 transforms to

(χ2 ) (χ1 [t]) Γ1 Θ1 , Btx Btx , Γ2 Θ2 mix (Btx ) Γ1 , Γ2∗ Θ1∗ , Θ2 ∗ w: Γ1 , Γ2 Θ1 , Θ2

3.113.34. The last inferences in ψ1 , ψ2 are ∃ : r, ∃ : l: symmetric to 3.113.33. 3.113.35

(χ2 ) (χ1 ) A, Γ1 Θ1 Γ2 Θ2 , A ¬:r ¬:l ¬A, Γ2 Θ2 Γ1 Θ1 , ¬A mix (¬A) Γ1 , Γ2 Θ1 , Θ2

reduces to

(χ2 ) (χ1 ) Γ2 Θ2 , A A, Γ1 Θ1 mix (A) Γ1∗ , Γ2 Θ1 , Θ2∗ ∗ w: Γ1 , Γ2 Θ1 , Θ2

3.113.36. (χ2 ) (χ1 ) (χ3 ) A, Γ1 Θ1 , B Γ Θ, A B, ∆ Λ →: r →: l Γ1 Θ1 , A → B A → B, Γ, ∆ Θ, Λ mix (A → B) Γ1 , Γ, ∆ Θ1 , Θ, Λ reduces to

(χ1 ) (χ3 ) A, Γ1 Θ1 , B B, ∆ Λ (χ2 ) mix (B) Γ Θ, A A, Γ1 , ∆∗ Θ1∗ , Λ mix (A) Γ1+ , Γ, ∆∗+ Θ1∗ , Θ+ , Λ ∗ w: Γ1 , Γ, ∆ Θ1 , Θ, Λ

3.12. rank > 2: 3.121. right-rank > 1: 3.121.1. The mix formula occurs in the antecedent of the end-sequent of ψ1 . (ψ2 ) (ψ1 ) Π Σ ∆ Λ mix (A) Π, ∆∗ Σ ∗ , Λ

63

64

M. Baaz and A. Leitsch

transforms to

(ψ2 ) δ Λ w :∗ c : ∗ Π, ∆∗ Σ ∗ , Λ

3.121.2. The mix formula does not occur in the antecedent of the end-sequent of ψ1 . 3.121.21. Let r be one of the rules w : l or c : l; then (χ1 ) (ψ1 ) ∆ Λ r Π Σ Θ Λ mix (A) Π, Θ∗ Σ ∗ , Λ transforms to

(χ1 ) (ψ1 ) Π Σ ∆ Λ mix (A) Π, ∆∗ Σ ∗ , Λ r Π, Θ∗ Σ ∗ , Λ

Note that r may be ”degenerated”, i.e. it can be skipped if the sequent does not change. 3.121.22. Let r be an arbitrary unary rule (diﬀerent from c : l, w : l) and let C ∗ be empty if C = A and C otherwise. The formulas B and C may be equal or diﬀerent or simply nonexisting. Let us assume that ψ is of the form (χ1 ) B, Γ Ω1 (ψ1 ) r Π Σ C, Γ Ω2 mix (A) Π, C ∗ , Γ ∗ Σ ∗ , Ω2 Let τ be the proof (ψ1 ) (χ1 ) Π Σ B, Γ Ω1 mix (A) Π, B ∗ , Γ ∗ Σ ∗ , Ω2 w :∗ Π, B, Γ ∗ Σ ∗ , Ω2 r Π, C, Γ ∗ Σ ∗ , Ω2 3.121.221. A = C: then ψ transforms to τ . 3.121.222. A = C and A = B: in this case C is the principal formula of r. Then ψ transforms to (τ ) (ψ1 ) Π Σ Π, A, Γ ∗ Σ ∗ , Ω2 mix (A) Π, Π ∗ , Γ ∗ Σ ∗ , Σ ∗ , Ω2 ∗ c : Π, Γ ∗ Σ ∗ , Ω2

Comparing the Complexity of Cut-Elimination Methods

65

3.121.223 A = B = C. Then Ω1 = Ω2 and ψ transforms to (χ1 ) (ψ1 ) Π Σ A, Γ Ω1 mix (A) Π, Γ ∗ Σ ∗ , Ω1 r Π, Γ ∗ Σ ∗ , Ω2 3.121.23. The last inference in ψ2 is binary: 3.121.231. The case ∧ : r. Here (χ2 ) (χ1 ) Γ1 Θ1 , B Γ2 Θ2 , C (ψ1 ) ∧:r Π Σ Γ1 , Γ2 Θ1 , Θ2 , B ∧ C mix (A) Π, Γ1∗ , Γ2∗ Σ ∗ , Θ1 , Θ2 , B ∧ C transforms to (χ1 ) (χ1 ) (ψ1 ) (ψ1 ) Π Σ Γ1 Θ1 , B Π Σ Γ2 Θ2 , C mix (A) mix (A) Π, Γ1∗ Σ ∗ , Θ1 , B Π, Γ2∗ Σ ∗ , Θ2 , C ∧ :r Π, Γ1∗ , Γ2∗ Σ ∗ , Σ ∗ , Θ1 , Θ2 , B ∧ C ∗ c:r Π, Γ1∗ , Γ2∗ Σ ∗ , Θ1 , Θ2 , B ∧ C 3.121.232. The case ∨ : l. Then ψ is of the form (χ1 ) (χ2 ) B, Γ1 Θ1 C, Γ2 Θ2 (ψ1 ) ∨:l Π Σ B ∨ C, Γ1 , Γ2 Θ1 , Θ2 mix (A) Π, (B ∨ C)∗ , Γ1∗ , Γ2∗ Σ ∗ , Θ1 , Θ2 Again (B ∨ C)∗ is empty if A = B ∨ C and B ∨ C otherwise. We ﬁrst deﬁne the proof τ : (χ1 ) (χ1 ) (ψ1 ) (ψ1 ) Π Σ B, Γ1 Θ1 Π Σ C, Γ2 Θ2 mix (A) mix (A) B ∗ , Π, Γ1∗ Σ ∗ , Θ1 C ∗ , Π, Γ2∗ Σ ∗ , Θ2 x x B, Π, Γ1∗ Σ ∗ , Θ1 C, Π, Γ2∗ Σ ∗ , Θ2 ∨:l ∗ ∗ ∗ B ∨ C, Π, Π , Γ1 , Γ2 Σ ∗ , Σ ∗ , Θ1 , Θ2 Note that, in case A = B or A = C, the inference x is w : l; otherwise x is the identical transformation and can be dropped. If (B ∨ C)∗ = B ∨ C then ψ transforms to τ c :∗ Π, B ∨ C, Γ1∗ , Γ2∗ Σ ∗ , Θ1 , Θ2 If, on the other hand, (B ∨ C)∗ is empty (i.e. B ∨ C = A) then we transform ψ to (ψ1 ) Π Σ τ mix (A) Π, Π ∗ , Π ∗ , Γ1∗ , Γ2∗ Σ ∗ , Σ ∗ , Σ ∗ , Θ1 , Θ2 c :∗ Π, Γ1∗ , Γ2∗ Σ ∗ , Θ1 , Θ2

66

M. Baaz and A. Leitsch

3.121.233. The last inference in ψ2 is →: l. Then ψ is of the form: (χ1 ) (χ2 ) Γ Θ, B C, ∆ Λ (ψ1 ) →: l Π Σ B → C, Γ, ∆ Θ, Λ mix (A) Π, (B → C)∗ , Γ ∗ , ∆∗ Σ ∗ , Θ, Λ As in 3.121.232 (B → C)∗ = B → C for B → C = A and (B → C)∗ empty otherwise. 3.121.233.1. A occurs in Γ and in ∆. Again we deﬁne a proof τ : (χ2 ) (ψ1 ) Π Σ C, ∆ Λ (χ1 ) (ψ1 ) mix (A) Π Σ Γ Θ, B C ∗ , Π, ∆∗ Σ ∗ , Λ x mix (A) Π, Γ ∗ Σ ∗ , Θ, B C, Π, ∆∗ Σ ∗ , Λ →: l B → C, Π, Γ ∗ , Π, ∆∗ Σ ∗ , Θ, Σ ∗ , Λ If (B → C)∗ = B → C then, as in 3.121.232, ψ is transformed to τ + some additional contractions. Otherwise an additional mix with mix formula A is appended. 3.121.233.2 A occurs in ∆, but not in Γ . As in 3.121.233.1 we deﬁne a proof τ : (ψ1 ) (χ2 ) Π Σ C, ∆ Λ mix (A) C ∗ , Π, ∆∗ Σ ∗ , Λ (χ1 ) x Γ Θ, B C, Π, ∆∗ Σ ∗ , Λ →: l B → C, Γ, Π, ∆∗ Θ, Σ ∗ , Λ Again we distinguish the cases B → C = A and B → C = A and deﬁne the transformation of ψ exactly like in 3.121.233.1. 3.121.233.3 A occurs in Γ , but not in ∆: analogous to 3.121.233.2. 3.121.234. The last inference in ψ2 is mix (B) for some formula B. Then ψ is of the form (χ1 ) (χ2 ) Γ1 Θ1 Γ2 Θ2 (ψ1 ) mix (B) Π Σ Γ1 , Γ2+ Θ1+ , Θ2 mix (A) Π, Γ1∗ , Γ2+∗ Σ ∗ , Θ1+ , Θ2 3.121.234.1 A occurs in Γ1 and in Γ2 . Then ψ transforms to (χ2 ) (ψ1 ) Π Σ Γ2 Θ2 mix (A) Π, Γ2∗ Σ ∗ , Θ2 mix (B) Π, Π + , Γ1∗ , Γ2+∗ Σ ∗+ , Σ ∗+ , Θ1+ , Θ2 ∗ c : , w :∗ Π, Γ1∗ , Γ2+∗ Σ ∗ , Θ1+ , Θ2

(χ1 ) (ψ1 ) Π Σ Γ1 Θ1 mix (A) Π, Γ1∗ Σ ∗ , Θ1

Comparing the Complexity of Cut-Elimination Methods

67

Note that, for A = B, we have Γ2∗+ = Γ2∗ and Σ ∗+ = Σ ∗ ; Γ2∗+ = Γ2+∗ holds in all cases. 3.121.234.2 A occurs in Γ1 , but not in Γ2 . In this case we have Γ2+∗ = Γ2 and we transform ψ to (χ1 ) (ψ1 ) Π Σ Γ1 Θ1 (χ2 ) mix (A) Γ2 Θ2 Π, Γ1∗ Σ ∗ , Θ1 Π, Γ1∗ , Γ2+ Σ ∗ , Θ1+ , Θ2

mix (B)

3.121.234.3 A is in Γ2 , but not in Γ1 : symmetric to 3.121.234.2. 3.122. right-rank = 1 and left-rank > 1: symmetric to 3.121.

Program Extraction from Gentzen’s Proof of Transﬁnite Induction up to ε0 Ulrich Berger Department of Computer Science, University of Wales Swansea, Singleton Park, Swansea SA2 8PP, UK. [email protected]

Abstract. We discuss higher type constructions inherent to intuitionistic proofs. As an example we consider Gentzen’s proof of transﬁnite induction up to the ordinal ε0 . From the constructive content of this proof we derive higher type algorithms for some ordinal recursive hierarchies of number theoretic functions as well as simple higher type primitive recursive deﬁnitions of tree ordinals of all heights < ε0 .

1

Introduction

According to the Brouwer-Heyting-Kolmogorov interpretation [19] a proof of an implication A → B is a construction transforming a (hypothetical) proof of A into a proof of B. Applying this interpretation to nested implication one is led to some kind of ‘higher type’ constructions. For example a proof of (A → B) → C is a construction transforming a construction from proofs of A to proofs of B to a proof of C. Technically the constructive content of an intuitionistic proof can be made explicit by extracting from it a program ‘realizing’ the proven formula. This program may involve primitive recursion if the proof involves induction, and it may involve higher type functionals if the proof contains subproofs of formulas containing nested implications. We will illustrate the role of higher types by means of a theorem in proof theory, namely Gentzen’s proof of transﬁnite induction up to the ordinal ε0 [5] (see also e.g. [11]). Gentzen’s proof involves nesting of implications of unbounded depth, and consequently the program extracted from it contains functionals of arbitrarily high types. When applying Gentzen’s theorem to predicates expressing the totality of certain hierarchies of number theoretic functions deﬁned by transﬁnite recursion along ε0 one obtains higher type algorithms for these hierarchies which do not use transﬁnite recursion along the wellordering ε0 , but primitive recursion in higher types instead. In the case of the fast growing hierarchy (the transﬁnite extension of the Ackermann function) one obtains an algorithm due to Schwichtenberg. Surprisingly, the higher type algorithms are more eﬃcient than those using transﬁnite recursion along the well-ordering ε0 . The trade-oﬀ between transﬁnite recursion and higher types has been analyzed in detail by Schwichtenberg [12,14] and Terlouw [16,17]. What seems to be new in our presentation is the fact that the functionals obtained by passing R. Kahle, P. Schroeder-Heister, and R. St¨ ark (Eds.): PTCS 2001, LNCS 2183, pp. 68–77, 2001. c Springer-Verlag Berlin Heidelberg 2001

Program Extraction from Gentzen’s Proof of Transﬁnite Induction up to ε0

69

from transﬁnite recursion to higher types are precisely the constructive content of Gentzen’s proof. A similar remark applies to our second application, the extraction of higher type primitive recursive deﬁnitions of tree ordinals < ε0 . The method of using iteration and higher type functionals to deﬁne (notations for) ordinals goes back to Neumer [9,10] and Feferman [4], and has been pursued recently by Danner [3] and Hancock [7]. Our constructions are closely related to Aczel’s work in [1], the diﬀerence being that Aczel uses transﬁnite types (and thus is able to construct larger ordinals). The plan of this paper is follows. In part 2 we review Gentzen’s proof reorganizing it such that it can be smoothly formalized. Using a variant of Kreisel’s modiﬁed realizability interpretation we then extract, in part 3, from the formalized proof an abstract higher type algorithm, which, in part 4, is specialized to concrete primitive recursive higher type algorithms for the fast growing hierarchy and tree ordinals of all heights < ε0 .

2 2.1

Transﬁnite Induction up to ε0 Ordinals < ε0

Let us begin with a brief review of some basic facts on ordinals < ε0 . Each such ordinal can be uniquely written in Cantor normal form with base ω: x =CNF ω x1 + . . . + ω xn , which means that x = ω x1 + . . . + ω xn with n > 0 and x > x1 ≥ . . . ≥ xn . If furthermore y =CNF ω y1 + . . . + ω ym , then x < y iﬀ either the sequence (x1 , . . . , xn ) is a proper initial segment of (y1 , . . . , ym ) or else there is some i < min(n, m) such that (x1 , . . . , xi ) = (y1 , . . . , yi ) and xi+1 < yi+1 . We write NF(x, y) if x =CNF ω x1 + . . . + ω xn and xn ≥ y. Hence in that case x + ω y =CNF ω x1 + . . . + ω xn + ω y . If NF(x, y) and k is a natural number then we also set x + ω y k := x + ω y + . . . + ω y (k-times ω y ) (then clearly x + ω y k =CNF x + ω y + . . . + ω y ). Every ordinal < ε0 is either 0 or else of the form x + 1 := x + ω 0 , i.e. a successor ordinal, or else of the form x + ω y where y > 0 and NF(x, y), i.e. a limit ordinal. For every limit ordinal z and every natural number k we deﬁne the k-th member of the fundamental sequence of z, denoted z[k], recursively as follows: (x + ω y+1 )[k] := x + ω x k, if NF(x, y + 1). (x + ω y )[k] := x + ω y[k] , if NF(x, y) and y is a limit ordinal. Clearly x < x + 1 and z[k] < z if z is a limit ordinal. Moreover x + 1 is the least ordinal above x, and z is the least ordinal above all z[k]. Clearly for every ordinal 0 < z < ε0 there exist unique ordinals x, y < z such that NF(x, y) and z = x + ω y . This gives rise to an obvious coding of ordinals < ε0 by ﬁnite binary trees: 0 is coded by the empty tree, and if NF(x, y) then x + ω y is coded by the tree composed by the trees coding x and y respectively. Henceforth we will identify ordinals < ε0 with their codes. Obviously all functions and relations deﬁned above are primitive recursive with respect to this coding.

70

2.2

U. Berger

The Principle of Transﬁnite Induction

We state the principle of transﬁnite induction up to ε0 in such a form that Gentzen’s proof can be smoothly formalized. In this form the principle roughly says that a property holds for all ordinals < ε0 provided it holds for 0 and is closed under successors and limits of fundamental sequences. In order to make this precise we deﬁne for a property P of ordinals < ε0 ProgS (P ) :↔ ∀x.P (x) → P (x + 1), ProgL (P ) :↔ ∀x.Lim(x) → ∀k P (x[k]) → P (x), where Lim(x) means that x is a limit ordinal. Transﬁnite induction up to ε0 is now expressed by the scheme P (0) → ProgS (P ) → ProgL (P ) → ∀x P (x).

(1)

which is equivalent to the more familiar scheme ∀x (∀y < x P (y) → P (x)) → ∀x P (x). Transﬁnite induction up to ε0 must not be confused with induction along the built up of ordinals < ε0 viewed as binary ﬁnite binary trees. We will refer to the latter principle, which is equivalent to ordinary induction on the natural numbers, as structural induction. As an example of how to apply (1) we consider the following recursively deﬁned hierarchy of number theoretic functions, which transﬁnitely extends the Ackermann hierarchy and is usually called the fast growing hierarchy: F0 (n) = 2n ,

Fx+1 (n) = Fx(n) (n),

Fy (n) = Fy[n] (n)

where y is a limit ordinal. Applying (1) to the predicate P (x) :↔ ∀n ∃k F (x, n, k) where F is a suitably axiomatized predicate such that F (x, n, k) expresses “Fx (n) = k” we obtain from (1) ∀x P (x), i.e. the totality of all Fx (x < ε0 ), since P (0), ProgS (P ), and ProgL (P ) obviously hold. 2.3

Gentzen’s Proof in Heyting’s Arithmetic

We now give a rather detailed proof of Gentzen’s result which can be easily formalized in Heyting Arithmetic, HA. It will allow us to see its constructive content in a rather direct way. Of course, since according to G¨ odel’s and Gentzen’s results transﬁnite induction up to ε0 is not provable in ﬁrst order arithmetic, the proof cannot be fully formalized in HA, but some inductions have to be done on the meta level. However this won’t be an obstacle for our purposes. Let P be a property of ordinals < ε0 . In order to prove (1) we assume that P is progressive, i.e. satisﬁes P (0), ProgS (P ) and ProgL (P ). We have to show

Program Extraction from Gentzen’s Proof of Transﬁnite Induction up to ε0

71

∀x P (x). Gentzen’s crucial idea to prove this was to introduce the following predicates Pn . P0 (y) :↔ P (y) Pn+1 (y) :↔ ∀x.NF(x, y) → Pn (x) → Pn (x + ω y ). Note that for every n the predicate Pn is deﬁned in the language of ﬁrst order arithmetic. However the binary predicate Q(n, x) :↔ Pn (x) is not arithmetical. This is one reason why the following proof is not formalizable in ﬁrst order arithmetic. Lemma. Pn (0) for every n. Proof. We show ﬁrst ProgL (Pn ) by induction on n, then ProgS (Pn ) and ﬁnally Pn (0). For all three statements the case n = 0 holds by assumption. 1. ProgL (Pn+1 ). Assume Lim(y) and ∀k Pn+1 (y[k]). We have to show Pn+1 (y). So assume NF(x, y) and Pn (x) and show Pn (x+ω y ). Since by induction hypothesis ProgL (Pn ) holds and x+ω y is a limit ordinal, it suﬃces to show Pn ((x+ω y )[k]) for all k. We have NF(x, y[k]) and (x + ω y )[k] = x + ω y[k] . Hence Pn (x + ω y[k] ) since by assumption Pn+1 (y[k]). 2. ProgS (Pn+1 ). Assume Pn+1 (y). We have to show Pn+1 (y + 1). Assume NF(x, y + 1) and Pn (x). We have to show Pn (x + ω y+1 ). Since x + ω y+1 is a limit ordinal and by 1. we have ProgL (Pn ) it suﬃces to show Pn (x + ω y+1 [k]) for all k. We have (x + ω y+1 )[k] = x + ω y k. Therefore, since NF(x, y) and Pn (x), by k-fold application of Pn+1 (y) we get Pn (x + ω y k). 3. Pn+1 (0). Assume Pn (x). Then Pn (x + ω 0 ) holds since we have ProgS (Pn ) by 2. Theorem. ∀x P (x). Proof. We show by structural induction on x that Pn (x) holds for all n. In particular then P0 (x) i.e. P (x) holds. Pn (0) holds for all n by the lemma If x > 0 then there exist x0 , x1 such that NF(x0 , x1 ) and x = x0 + ω x1 (i.e. x0 , x1 are the immediate subtrees of x). By induction hypothesis we have Pn+1 (x1 ) and Pn (x0 ). Hence Pn (x). Remark. The reader may notice that this proof has a striking similarity with the Tait/Troelstra proof of strong normalization for G¨ odel’s system T of primitive recursive functionals of ﬁnite types [18]. The predicate Pn corresponds to the strong computability predicate for terms of type level n.

3 3.1

The Constructive Content of Gentzen’s Proof Formal Proof Terms

In order to extract a program from the proof above we write down the formal proof terms corresponding to the lemma and the theorem in the previous section.

72

U. Berger

Since we are only interested in the extracted programs we omit some parts of the proof which do not have computational content. In particular subderivations proving quantiﬁer free formulas like NF(x, y), Lim(y) etc. are omitted. We formalize the proof in a natural deduction calculus and write derivations as typed λ-terms. We hope that the terms are understandable although we did not give P (0) Prog (P ) Prog (P ) a deﬁnition of the syntax of proof terms. Let uZ , uS S and uL L be assumption variables representing the general assumptions in 2.3. Formalizing Prog (P ) Prog (P ) Pn (0) . dL,n is deﬁned the lemma we deﬁne derivations dL,n L n dS,n S n , and dZ,n by recursion on n which means that the inductive argument is done on the meta level. dL,0 := uL , dS,0 := uS , dZ,0 := uZ , dL,n+1 := λyλu∀k Pn+1 (y[k]) λxλv Pn (x) .dL,n (x + ω y )(λk.ukxv). dS,n+1 := λyλuPn+1 (y) λxλv Pn (x) . y dL,n (x + ω y+1 )Ind[v, λkλwPn (x+ω k) .u(x + ω y k)w]. dZ,n+1 := λxλv Pn (x) .dS,n xv. Note that in the derivation dL,n the operator, Ind[., .], corresponds to the induction rule that allows us to conclude ∀k A(k) from A(0) and ∀k(A(k) → A(k +1)). Here we used induction for the formula A(k) := Pn (x + ω y k). Pn (x) Finally, formalizing the theorem, we deﬁne derivation terms en,x by structural recursion on x (hence also here induction is done on the meta level). en,0 := dZ,n , 3.2

en,x+ωy := en+1,y en,x .

Program Extraction

In order to obtain a program from the derivation terms we apply a formalized version of Kreisel’s modiﬁed realizability interpretation [8]. This interpretation odel’s system T [6] realizing the maps each derivation dA to a term ep(d)τ (A) in G¨ formula A. τ (A), the type of the ‘potential realizers’ of A, is a ﬁnite type built from ground types like the type IN of natural numbers by cartesian products, ×, and function spaces, →. For details see [18]. For example we have τ (Pn+1 ) = ε0 → τ (Pn ) → τ (Pn ), τ (ProgS (Pn )) = ε0 → τ (Pn ) → τ (Pn ), τ (ProgL (Pn )) = ε0 → (IN → τ (Pn )) → τ (Pn ). Since the predicate P has not been speciﬁed yet, we neither know the type τ (P ) = τ (P0 ) := τ (P (x)) (τ (P (x)) does not depend on x) nor do we know what it means that a term tτ (P ) realizes the formula P (x). For a moment we regard these entities as parameters (which we can instantiate as we wish later on) and extract ‘abstract’ programs depending on free variables uZ , uS , and uL , standing for unknown realizers of P (0), ProgS (P ), and ProgL (P ), respectively. In this abstract form the extracted programs look very similar to the derivations. Just the types have changed, and induction is replaced by primitive recursion.

Program Extraction from Gentzen’s Proof of Transﬁnite Induction up to ε0

73

ep(dL,0 )τ (ProgL (Pn )) := uL , ep(dS,0 )τ (ProgS (Pn )) := uS , ep(dZ,0 )τ (Pn ) := uZ , ep(dL,n+1 )τ (ProgL (Pn+1 )) := λyλuIN→τ (Pn+1 ) λxλv τ (Pn ) . ep(dL,n )(x + ω y )(λk.ukxv). ep(dS,n+1 )τ (ProgS (Pn+1 )) := λyλuτ (Pn+1 ) λxλv τ (Pn ) . ep(dL,n )(x + ω y+1 )Rec[v, λkλwτ (Pn ) .u(x + ω y k)w]. ep(dZ,n+1 )τ (Pn+1 ) := λxλv τ (Pn ) .ep(dS,n )xv. Finally

ep(en,0 ) := dZ,n ,

ep(en+1,x+ωy ) := ep(en+1,y )ep(en,x ).

Recall that e0,x derives P (x), and hence the program ep(e0,x ) realizes P (x).

4

Primitive Recursive Programs for Ordinal Recursive Functions

Consider a family of objects (Hx )x<ε0 deﬁned by transﬁnite recursion on x. H0 = Φ0 ,

Hx+1 = ΦS (x, Hx ),

Hy = ΦL (y, λkHy[k] )

(if Lim(y)),

where the (common) type τ of the Hx is arbitrary and Φ0 : τ , ΦS : ε0 → τ → τ , ΦL : ε0 → (IN → τ ) → τ are some unspeciﬁed functionals given ahead. If, for example, we set τ := IN → IN and Φ0 (k) = 2k ,

ΦS (x, f )(k) = f (k) (k) ,

ΦL (y, g)(k) = g(k, k)

then (Hx )x<ε0 will be the fast growing hierarchy, deﬁned in 2.2. In order to obtain via program extraction, as sketched in the previous section, algorithms computing the Hx , we extend our formal system HA by a new predicate symbol GH . The intended meaning of GH (x, a) is ‘Hx = a’. GH could be deﬁned inductively, namely as the least predicate satisfying GH (0, Φ0 ) GH (x, a) → GH (x + 1, ΦS (a)) Lim(y) → ∀kGH (y[k], f (k)) → GH (y, ΦL (y, f )) We will add these three formulas as axioms to our system (without, however, stating the minimality of GH ). Since these new axioms do not contain existential quantiﬁers or disjunctions the program extraction method is not aﬀected by this extension. We now use transﬁnite induction on x to prove the existence of Hx , i.e. we set P (x) :↔ ∃aGH (x, a). Note that now τ (P ) = τ , and a mr P (x) ↔ GH (x, a). Furthermore uS mr ProgS (P ) ↔ [∀x . GH (x + 1, a) → GH (x + 1, uS (a))], uL mr ProgL (P ) ↔ [∀y∀f . Lim(y) → ∀kGH (y[k], f (k)) → GH (y, uL (y, f ))]

74

U. Berger

Hence we may set uZ := Φ0 , uS := ΦS , uL := ΦL and obtain a program ep(e0,x )τ realizing P (x), i.e. GH (x, ep(e0,x )), which means that ep(e0,x ) = Hx . Therefore we have obtained a higher type primitive recursive algorithm for Hx (relative to Φ0 , ΦS , ΦL ). If we are even more speciﬁc and require in addition that ΦS and ΦL do not depend on their ﬁrst argument – as it is the case for the fast growing hierarchy – then, by normalization, all ordinal arguments disappear, and we obtain simpler programs. Hence let us now consider the more restricted schema H0 = Φ0 ,

Hx+1 = ΦS (Hx ),

Hy = ΦL (λkHy[k] ),

(if Lim(y)).

where Φ0 : τ , ΦS : τ → τ , and ΦL : (IN → τ ) → τ . Setting τ0 = IN → IN, τn+1 = τn → τn we obtain the following programs rn : (IN → τn ) → τn , tn : τn , tn,x : τn corresponding to ep(dL,n ), ep(dZ,n ), ep(en,x ) respectively (we use the variables un : IN → τn and vn : τn ). r0 = ΦL , rn+1 = λun+1 λvn .rn (λk.un+1 kvn ), t0 = Φ0 , t1 = ΦS , (k) tn+2 = λvn+1 λvn .rn (λk . vn+1 vn ), tn,0 := tn , tn,x+ωy := tn+1,y tn,x with the property that GH (x, t0,x ) is provable, that is, t0,x deﬁnes Hx . The terms tn+2 can β-equivalently be written in the following, slightly less formal, but more readable way. (k)

tn+2 vn+1 vn . . . v0 = ΦL (λk . vn+1 vn . . . v0 ). Note that t0,x realizes P (x), which, by deﬁnition of P means that t0,x is a program computing Hx . 4.1

The Fast Growing Hierarchy

Recall that in order to obtain the fast growing hierarchy as an instance of the family (Hx )x<ε0 we have to set τ := IN → IN and Φ0 (k) = 2k ,

ΦS (x, f )(k) = f (k) (k) ,

ΦL (y, g)(k) = g(k, k)

Now the terms tn become t0 k = 2k , (k) tn+1 vn . . . v0 k = vn vn−1 . . . v0 k. Hence we see that tn is precisely F0n+1 in Schwichtenberg’s notation [13].

Program Extraction from Gentzen’s Proof of Transﬁnite Induction up to ε0

4.2

75

Wellfounded Trees of Heights < ε0

Finally, we use our extracted program to obtain higher type primitive recursive deﬁnitions of wellfounded trees of all heights < ε0 . To this end we add to our formal system a sort tree and constants 0: tree,

succ: tree → tree ,

lim: (IN → tree) → tree

acting as constructors for countable wellfounded trees. Our family (Hx )x<ε0 now simply interprets each ordinal notation x < ε0 as a countable wellfounded tree in the obvious way: H0 = 0,

Hx+1 = succ(Hx ),

Hy = lim(λkHy[k] ),

(if Lim(y))

Hence we have τ = tree, Φ0 = 0, ΦS = succ, ΦL = lim and we get t0 = 0, t1 v0 = succ(v0 ), (k) tn+2 vn+1 vn . . . v0 = lim(λk . vn+1 vn . . . v0 ). tn,0 := tn , tn,x+ωy := tn+1,y tn,x . with the property that t0,x deﬁnes Hx . For example the ordinals ωn (ω0 := succ(0), ωn+1 := wωn ) which approximate ε0 , are for n > 0 mapped to the trees Hωn = lim(λk . t(k) n tn−1 . . . t0 ) This is more or less the same iterative construction of ωn as given by Aczel in [1], deﬁnition (1.8) (except that Aczel works with set-theoretic ordinals instead of tree ordinals). Remark. Conversely every closed term of type tree denotes a wellfounded tree of height < ε0 . This is so, because every such tree is provably (in HA) wellfounded and hence, again according to Gentzen [5], has height < ε0 . The concept of a provably wellfounded tree can be made precise as follows. Let P be a predicate on trees. Set Prog(P ) : ↔ P (0) ∧ ∀atree (P (a) → P (succ(a))) ∧ ∀f IN→tree (∀kP (f (k)) → P (lim(f ))) TI(P, atree ) : ↔ Prog(P ) → P (a) For a closed term t of type tree we say that (the tree deﬁned by) t is provably wellfounded if TI(P, t) is provable (in HA) for every predicate P . In order to see that every closed term ttree is indeed provably wellfounded take a predicate P and deﬁne predicates Pρ on ρ as follows:

76

U. Berger

PIN (k) : ↔ 0 = 0 Ptree (atree ) : ↔ P (atree ) Pρ→σ (f ρ→σ ) : ↔ ∀xρ (Pρ (x) → Pσ (f (x))) Now one proves for terms rρ with free variables xσi i the formulas Prog(P ) ∧ Pσi (xi ) → Pρ (r) i

by term induction on r. The hypothesis Prog(P ) is used in the cases r = 0, succ, lim.

5

Concluding Remarks

In this paper we analysed the constructive content of Gentzen’s proof of transﬁnite induction up to ε0 and obtained simple higher type primitive recursive deﬁnitions of the fast growing hierarchy and trees corresponding to ordinals < ε0 . I compared the eﬃciency of the ordinal recursive programs and the higher type programs, not for the fast growing hierarchy, but for the Hardy hierarchy H0 (n) = n,

Hx+1 (n) = Hx (n + 1),

Hy (n) = Fy[n] (n)

(because for the Hardy hierarchy it turned out to be easier to ﬁnd interesting inputs where the programs terminate in reasonable time). The result was that the extracted higher type program was about 4 times faster than the ordinal recursive program above 1 . A more signiﬁcant speed up has been observed in an implementation of a higher type program for normalizing simply typed lambda terms. This program has been shown to be the constructive content of the Tait/Troelstra strong normalization proof using logical predicates whose similarity with Gentzen’s proof we already mentioned [2]. It would be interesting to see whether a similarly smooth computational analysis of proofs of transﬁnite induction up to higher ordinals such as the Sch¨ utteFeferman ordinal, Γ0 , or the Bachmann-Howard ordinal, φεΩ+1 , [11], is possible. A nice formal proof of transﬁnite induction up to Γ0 is given in [7]. It should be possible to extract from this proof higher type deﬁnitions of ordinals < Γ0 using some kind of predicative polymorphism. Acknowledgments. I am grateful to Peter Hancock for stimulating discussions and important pointers to the literature.

1

http://www-compsci.swan.ac.uk/∼csulrich/recent-papers.html

Program Extraction from Gentzen’s Proof of Transﬁnite Induction up to ε0

77

References 1. P. Aczel. Describing ordinals by functionals of transﬁnite type. Journal of Symbolic Logic 37(1), 35–47, 1972. 2. U. Berger. Program extraction from normalization proofs. Typed Lambda Calculi and Applications (TLCA’93), LNCS 664, 91–106, 1993. 3. N. Danner. Ordinals and ordinal functions representable in the simply typed lambda calculus. Annals of Pure and Applied Logic 97, 179–201, 1999. 4. S. Feferman. Hereditarily replete functionals over the ordinals. Intuitionism and Proof theory, J. Myhill, editor, North-Holland, 289–301, 1970. 5. G. Gentzen. Beweisbarkeit und Unbeweisbarkeit von Anfangsf¨ allen der transﬁniten Induktion in der reinen Zahlentheorie. Mathematische Annalen 119, 140–161, 1943. ¨ 6. K. G¨ odel. Uber eine bisher noch nicht ben¨ utzte Erweiterung des ﬁniten Standpunktes. Dialectica 12, 280–287, 1958. 7. P. Hancock. Ordinals and Interactive Programs. Unpublished, 2001. 8. G. Kreisel. Interpretation of analysis by means of constructive functionals of ﬁnite types. Constructivity in Mathematics, A. Heyting, editor, North–Holland, 101–128, 1959. 9. W. Neumer. Zur Konstruktion von Ordnungszahlen. Mathematische Zeitschrift. I, vol. 58, 319–413, 1953; II, vol. 59, 434–454, 1954; III, vol. 60, 1–16, 1954; IV, vol. 61, 47–69, 1954; V, vol. 64, 435–456, 1956. 10. W. Neumer. Algorithmen f¨ ur Ordnungzahlen und Normalfunktionen. Zeitschrift f¨ ur mathematische Logik und Grundlagen der Mathematik. I, vol. 3, 108–150, 1957; II, vol. 6, 1–65, 1960. 11. W. Pohlers. Proof Theory. SLNM 1407, 1989. 12. H. Schwichtenberg. Eine Klassiﬁkation der ε0 –rekursiven Funktionen. Zeitschrift f¨ ur mathematische Logik und Grundlagen der Mathematik 17, 61–74, 1971. 13. H. Schwichtenberg. Einige Anwendungen von unendlichen Termen und Wertfunktionalen. Mathematisches Institut der Universit¨ at M¨ unster, Habilitationsschrift, 1973. 14. H. Schwichtenberg. Elimination of higher type levels in deﬁnitions of primitive recursive functionals by means of transﬁnite recursion. Logic Colloquium 73 North– Holland, 279–303, 1975. 15. H. Schwichtenberg. Classifying Recursive Functions. In: E. Griﬀor, editor, Handbook of Recursion Theory, 533-586, North-Holland, 1999. 16. J. Terlouw. On deﬁnition trees of ordinal recursive functionals: reduction of the recursion orders by means of type level raising. Journal of Symbolic Logic 47, 395–402, 1982. 17. J. Terlouw. Reduction of higher type levels by means of an ordinal analysis of ﬁnite terms. Annals of Pure and Applied Logic 28, 73–102, 1985. 18. A. S. Troelstra. Metamathematical Investigations of Intuitionistic Arithmetic and Analysis. SLNM 344, 1973. 19. A. S. Troelstra and Dirk van Dalen. Constructivism in Mathematics. An Introduction. Volumes 121 and 123 of Studies in Logic and the Foundations of Mathematics, North–Holland, 1988.

Coherent Bicartesian and Sesquicartesian Categories Kosta Doˇsen and Zoran Petri´c Mathematical Institute, SANU, Knez Mihailova 35, p.f. 367, 11001 Belgrade, Yugoslavia, phone: 381 11 630 170, fax: 381 11 186 105, {kosta,zpetric}@mi.sanu.ac.yu

Abstract. Sesquicartesian categories are categories with nonempty ﬁnite products and arbitrary ﬁnite sums, including the empty sum. Coherence is here demonstrated for sesquicartesian categories in which the ﬁrst and the second projection from the product of the initial object with itself are the same. (Every bicartesian closed category, and, in particular, the category Set, is such a category.) This coherence amounts to the existence of a faithful functor from categories of this sort freely generated by sets of objects to the category of relations on ﬁnite ordinals. Coherence also holds for bicartesian categories where, in addition to this equality for projections, we have that the ﬁrst and the second injection to the sum of the terminal object with itself are the same. These coherences yield a very easy decision procedure for equality of arrows. Keywords: categorial proof theory, conjunction and disjunction, decidability of equality of deductions Mathematics Subject Classiﬁcation (2000): 18A30, 18A15, 03G30, 03F05

1

Introduction

The connectives of conjunction and disjunction in classical and intuitionistic logic make a structure corresponding to a distributive lattice. Among nonclassical logics, and, in particular, among substructural logics, one ﬁnds also conjunction and disjunction that make a structure corresponding to a free lattice, which is not distributive. In proof theory, however, we are not concerned only with a consequence relation, which in the case of conjunction and disjunction gives rise to a lattice order, but we may distinguish certain deductions with the same premise and the same conclusion. For example, there are two diﬀerent deductions from A∧A to A, one corresponding to the ﬁrst projection and the other to the second projection, and two diﬀerent deductions from A to A ∨ A, one corresponding to the ﬁrst injection and the other to the second injection. R. Kahle, P. Schroeder-Heister, and R. St¨ ark (Eds.): PTCS 2001, LNCS 2183, pp. 78–92, 2001. c Springer-Verlag Berlin Heidelberg 2001

Coherent Bicartesian and Sesquicartesian Categories

79

If we identify deductions guided by normalization, or cut elimination, we will indeed distinguish the members in each of these two pairs of deductions, and we will end up with natural sorts of categories, whose arrows stand for deductions. Instead of nondistributive lattices, we obtain then categories with binary products and sums (i.e. coproducts), where the product × corresponds to conjunction and the sum + to disjunction. If, in order to have all ﬁnite products and sums, we add also the empty product, i.e. the terminal object, which corresponds to the constant true proposition, and the empty sum, i.e. the initial object, which corresponds to the constant absurd proposition, we obtain bicartesian categories, namely categories that are at the same time cartesian, namely, with all ﬁnite products, and cocartesian, with all ﬁnite sums. Bicartesian categories need not be distributive. One may then enquire how useful is the representation of deductions involving conjunction and disjunction in bicartesian categories for determining which deductions are equal and which are not. A drawback is that here cut-free, i.e. composition-free, form is not unique. For example, for f : A → C, g : A → D, h : B → C and j : B → D we have the following two composition-free arrow terms f, g : A → C × D h, j : B → C × D [f, g, h, j] : A + B → C × D [f, h] : A + B → C [g, j] : A + B → D [f, h], [g, j] : A + B → C × D which designate the same arrow, but it is not clear which one of them is to be considered in normal form. The same problem arises also for distributive bicartesian categories, i.e. for classical and intuitionistic conjunction and disjunction. (This problem is related to questions that arise in natural deduction with Prawitz’s reductions tied to disjunction elimination, sometimes called “commuting conversions”.) Cut elimination may then be supplemented with a coherence result. The notion of coherence is understood here in the following sense. We say that coherence holds for some sort of category iﬀ for a category of this sort freely generated by a set of objects there is a faithful functor from it to a graphical category, whose arrows are sets of links between the generating objects. These links can be drawn, and that is why we call our category “graphical”. Intuitively, these links connect the objects that must remain the same after “generalizing” the arrows. We shall deﬁne precisely below the graphical category we shall use for our coherence results, and the intuitive notion of generalizing (which originates in [6] and [7]) will become clear. This category will be the category of relations on ﬁnite ordinals. In other cases, however, we might have a diﬀerent, but similar, category. It is desirable that the graphical category be such that through coherence we obtain a decision procedure for equality of arrows, and in good cases, such as those investigated in [3] and here, this happens indeed. Although this understanding of coherence need not be the most standard one, the paradigmatic results on coherence of [10] and [5] can be understood as faithfulness results of the type mentioned above, and this is how we understand

80

K. Doˇsen and Z. Petri´c

coherence here. We refer to [3], and papers cited therein, for further background motivation on coherence. This paper is a companion to [3], where it was shown that coherence holds for categories with binary, i.e. nonempty ﬁnite, products and sums, but without the terminal and the initial object, and without distribution. One obtains thereby a very easy decision procedure for equality of arrows. With the help of this coherence, it was also demonstrated that the categories in question are maximal, in the sense that in any such category that is not a preorder all the equations between arrows inherited from the free categories with binary products and sums are the same. An analogous maximality can be established for cartesian categories (see [1]) and cartesian closed categories (see [11] and [2]). In this paper we shall be concerned with categories with nonempty ﬁnite products and arbitrary ﬁnite sums, including the empty sum, i.e. the initial object. We call such categories sesquicartesian. As a matter of fact, sesquicocartesian would be a more appropriate label for these categories, since they are cocartesian categories—namely, categories with arbitrary ﬁnite sums—to which we add a part of the cartesian structure—namely, nonempty ﬁnite products. Sesquicartesian is more appropriate as a label for cartesian categories—namely, categories with arbitrary ﬁnite products—to which we add nonempty ﬁnite sums, which are a part of the cocartesian structure. However, sesquicocartesian and sesquicartesian categories so understood are dual to each other, and in a context where both types of categories are not considered, there is no necessity to burden oneself with the distinction, and make a strange new name even stranger. So we call here sesquicartesian categories with nonempty ﬁnite products and arbitrary ﬁnite sums. We shall show that coherence holds for sesquicartesian categories in which the ﬁrst and the second projection arrow from the product of the initial object with itself are equal. Every bicartesian closed category, and, in particular, the sesquicartesian category Set, is such a category. It is not true, however, that sesquicartesian categories that satisfy this condition for projections are maximal, in the sense in which cartesian categories, cartesian closed categories and categories with binary products and sums are maximal. Bicartesian categories are also not maximal. Coherence does not hold for bicartesian categories in general, but we shall see that it holds for bicartesian categories where besides the equality of the projection arrows mentioned above we also have that the ﬁrst and the second injection arrow to the sum of the terminal object with itself are equal. The bicartesian category Set is not such a category, but a few natural examples of such categories may be found in Section 7. Such categories are also not maximal. As in [3], our coherences for the special sesquicartesian and special bicartesian categories yield a very easy decision procedure for equality of arrows in the categories of this kind freely generated by sets of objects. Without maximality, however, the application of this decision procedure to an arbitrary category of the appropriate kind is limited. We can use this decision procedure only to show

Coherent Bicartesian and Sesquicartesian Categories

81

that two arrows inherited from the free category are equal, and we cannot use it to show that they are not equal. We said that this paper is a companion to [3], but except for further motivation, for which we refer to [3], we shall strive to make the present paper self-contained. So we have included here deﬁnitions and proofs that are just versions of material that may be found also in [3], but which for the sake of clarity it is better to adapt to the new context.

2

Free Coherent Bicartesian and Sesquicartesian Categories

The propositional language P is generated from a set of propositional letters L with the nullary connectives, i.e. propositional constants, I and O, and the binary connectives × and +. The fragment P×,+,O of P is obtained by omitting all formulae that contain I. For the propositional letters of P, i.e. for the members of L, we use the schematic letters p, q, . . ., and for the formulae of P, or of its fragments, we use the schematic letters A, B, . . . , A1 , . . . The propositional letters and the constants I and O are atomic formulae. The formulae of P in which no propositional letter occurs will be called constant objects. Next we deﬁne inductively the terms that will stand for the arrows of the free coherent bicartesian category B generated by L. Every term has a type, which is a pair (A, B) of formulae of P. That a term f is of type (A, B) is written f : A → B. The atomic terms are for every A and every B of P kA : A → I, 1 kA,B : A × B → A, 2 kA,B : A × B → B, wA : A → A × A,

1A : A → A,

lA : O → A, 1 lA,B : A → A + B, 2 lA,B : B → A + B, mA : A + A → A.

The terms 1A are called identities. The other terms of B are generated with the following operations on terms, which we present by rules so that from the terms in the premises we obtain the terms in the conclusion: f :A→B g:B→C g◦f :A→C f :A→B g:C→D f ×g :A×C →B×D

f :A→B g:C→D f +g :A+C →B+D

We use f, g, . . . , f1 , . . . as schematic letters for terms of B. The category B has as objects the formulae of P and as arrows equivalence classes of terms so that the following equations are satisﬁed for i ∈ {1, 2}: (cat 1) 1B ◦ f = f ◦ 1A = f, (cat 2) h ◦ (g ◦ f ) = (h ◦ g) ◦ f,

82

K. Doˇsen and Z. Petri´c

(×1) 1A × 1B = 1A×B , (×2) (g1 ◦ g2 ) × (f1 ◦ f2 ) = (g1 × f1 ) ◦ (g2 × f2 ), i i ◦ (f1 × f2 ) = fi ◦ kA , (k i ) kB 1 ,B2 1 ,A2 (w) wB ◦ f = (f × f ) ◦ wA , i ◦ wA = 1A , (kw1) kA,A 1 2 ) ◦ wA×B = 1A×B , (kw2) (kA,B × kA,B (k) for f : A → I, f = kA , 1 2 = kO,O , (kO) kO,O (+1) 1A + 1B = 1A+B , (+2) (g1 ◦ g2 ) + (f1 ◦ f2 ) = (g1 + f1 ) ◦ (g2 + f2 ), i i = lB ◦ fi , (li ) (f1 + f2 ) ◦ lA 1 ,A2 1 ,B2 (m) f ◦ mA = mB ◦ (f + f ), i = 1A , (lm1) mA ◦ lA,A 1 2 + lA,B ) = 1A+B , (lm2) mA+B ◦ (lA,B (l) for f : O → A, f = lA , 1 2 = lI,I . (lI) lI,I If we omit the equations (kO) and (lI), we obtain the free bicartesian category generated by L. The free coherent sesquicartesian category S generated by L has as objects the formulae of P×,+,O . In that case, terms in which kA occurs are absent, and the equations (k) and (lI) are missing. The remaining terms and equations are as in B. If from the equations of S we omit the equation (kO), we obtain the free sesquicartesian category generated by L. We shall call terms of B in which the letters l and m don’t occur K-terms. i (That means there are no subterms of K-terms of the form lA , lA,B and mA .) Terms of B in which the letters k and w don’t occur will be called L-terms.

3

Cut Elimination

For inductive proofs on the length of objects or terms, it is useful to be able to name the arrows of a category by terms that contain no composition. In this section we shall prove for B and S a theorem analogous to cut elimination theorems of logic, which stem from Gentzen [4]. This theorem says that every term of these categories is equal to a term of a special sort, which in an appropriate language would be translated by a composition-free term. We shall call terms of this special sort cut-free Gentzen terms. We deﬁne ﬁrst the following operations on terms of B, which we call Gentzen operations: 1 1 1 KB f =def. f ◦ kA,B , L1B f =def. lA,B ◦ f, 2 2 2 f =def. f ◦ kA,B , L2A f =def. lA,B ◦ f, KA f, g =def. (f × g) ◦ wC , [f, g] =def. mC ◦ (f + g).

Coherent Bicartesian and Sesquicartesian Categories

83

Starting from the identities and the terms kA and lA , for every A of P, and closing under the Gentzen operations, we obtain the set of cut-free Gentzen terms of B. The Gentzen terms of B are obtained by closing cut-free Gentzen terms under composition. It is easy to show that every term of B is equal in B to a Gentzen term, since we have the following equations: 1 1 1 = KB 1A , lA,B = L1B 1A , kA,B 2 2 2 lA,B = L2A 1B , kA,B = KA 1B , mA = [1A , 1A ], wA = 1A , 1A , 1 2 f × g = KC f, KA g, f + g = [L1D f, L2B g].

We need the following equations of B: i i f = KA (g ◦ f ), (L1) LiA g ◦ f = LiA (g ◦ f ), (K1) g ◦ KA i (L2) [g1 , g2 ] ◦ LiA f = gi ◦ f, (K2) KA g ◦ f1 , f2 = g ◦ fi , (K3) g1 , g2 ◦ f = g1 ◦ f, g2 ◦ f , (L3) g ◦ [f1 , f2 ] = [g ◦ f1 , g ◦ f2 ]

in order to prove the following theorem for B. CUT ELIMINATION. Every term is equal to a cut-free Gentzen term. Proof. We ﬁrst ﬁnd for an arbitrary term of B a Gentzen term h equal to it. Let the degree of a Gentzen term be the number of occurrences of Gentzen operations in this term. Take a subterm g◦f of h such that both f and g are cut-free Gentzen terms. We call such a term a topmost cut. We show that g ◦ f is either equal to a cut-free Gentzen term, or it is equal to a Gentzen term whose topmost cuts are of strictly smaller degree than the degree of g ◦ f . The possibility of eliminating the main compositions of topmost cuts, and hence of ﬁnding for h a cut-free Gentzen term, follows by induction on degree. The cases where f or g is 1A , or f is lA , or g is kA , are taken care of by i f or g is LiA g are taken care of by (cat 1), (l) and (k). The cases where f is KA (K1) and (L1). And the cases where f is [f1 , f2 ] or g is g1 , g2 are taken care of by (L3) and (K3). The following cases remain. If f is kA , then g is of a form covered by cases we dealt with above. i g, If f is f1 , f2 , then g is either of a form covered by cases above, or g is KA in which case we apply (K2). If f is LiA f , then g is either of a form covered by cases above, or g is [g1 , g2 ], in which case we apply (L2). This covers all possible cases. This proof, with the cases involving kA omitted, suﬃces to demonstrate Cut Elimination for S. Let the cut-free Gentzen K-terms of B be obtained from the identities and the terms kA by closing under + and the Gentzen operations K i and , . The Gentzen K-terms of B are obtained by closing the cut-free Gentzen K-terms under composition. Let, dually, the cut-free Gentzen L-terms of B be obtained from

84

K. Doˇsen and Z. Petri´c

the identities and the terms lA by closing under × and the Gentzen operations Li and [, ]. The Gentzen L-terms of B are obtained by closing the cut-free Gentzen L-terms under composition. Then we can prove the following version of Cut Elimination for the K-terms and the L-terms of B. CUT ELIMINATION FOR K-TERMS AND L-TERMS. Every K-term is equal to a cut-free Gentzen K-term, and every L-term is equal to a cut-free Gentzen L-term. Proof. It is easy to see that every K-term is equal in B to a Gentzen K-term. That this Gentzen K-term is equal to a cut-free Gentzen K-term is demonstrated as in the proof of Cut Elimination above by induction on the degree of topmost cuts. We have to consider the following additional cases. If f is kA or f1 , f2 , then g cannot be of the form g1 + g2 . If f is f1 + f2 , and g is not of a form already covered by cases in the proof above, then g is of the form g1 + g2 , in which case we apply (+2). This covers all possible cases. Cut Elimination for L-terms follows by duality. Let the cut-free Gentzen K-terms of S be terms of S obtained from the identities by closing under + and the Gentzen operations K i and , . The Gentzen K-terms of S are obtained by closing the cut-free Gentzen K-terms of S under composition. Let the cut-free Gentzen L-terms of S be terms of S obtained from the identities and the terms lA by closing under × and the Gentzen operations Li and [, ]. The Gentzen L-terms of S are obtained by closing the cut-free Gentzen L-terms of S under composition. Then we can establish Cut Elimination for K-terms and L-terms of S, where equality in B is replaced by equality in S. We just proceed as in the proof above, with inapplicable cases involving kA omitted.

4

The Graphical Category

We shall now deﬁne a graphical category G into which B and S can be mapped. The objects of G are ﬁnite ordinals. An arrow f : n → m of G will be a binary relation from n to m, i.e. a subset of n × m with domain n and codomain m. The identity 1n : n → n of G is the identity relation on n, and composition of arrows is composition of relations. For an object A of B, let |A| be the number of occurrences of propositional letters in A. For example, |(p × (q + p)) + (I × p)| is 4. We now deﬁne a functor G from B to G such that G(A) = |A|. It is clear that G(A × B) = G(A + B) = |A| + |B|. We deﬁne G on arrows inductively: G(1A )

= {(x, x) : x ∈ |A|} = 1|A| ,

1 ) = {(x, x) : x ∈ |A|}, G(kA,B 2 ) = {(x + |A|, x) : x ∈ |B|}, G(kA,B G(wA ) = {(x, x) : x ∈ |A|} ∪ {(x, x + |A|) : x ∈ |A|}, G(kA ) = ∅,

Coherent Bicartesian and Sesquicartesian Categories 1 G(lA,B ) 2 ) G(lA,B G(mA ) G(lA )

85

= {(x, x) : x ∈ |A|}, = {(x, x + |A|) : x ∈ |B|}, = {(x, x) : x ∈ |A|} ∪ {(x + |A|, x) : x ∈ |A|}, = ∅,

G(g ◦ f ) = G(g) ◦ G(f ), and for f : A → B and g : C → D, G(f × g) = G(f + g) = G(f ) ∪ {(x + |A|, y + |B|) : (x, y) ∈ G(g)}. 1 1 ) and G(lA,B ) are the same as sets of ordered pairs, Though G(1A ), G(kA,B in general they have diﬀerent domains and codomains, the ﬁrst being a subset of |A| × |A|, the second a subset of (|A| + |B|) × |A|, and the third a subset of |A| × (|A| + |B|). We have an analogous situation in some other cases. The arrows G(f ) of G can easily be represented graphically, by drawings linking propositional letters, as it is illustrated in [3]. This is why we call this category ”graphical”. It is easy to check that G is a functor from B to G. We show by induction on the length of derivation that if f = g in B, then G(f ) = G(g) in G. (Of course, G preserves identities and composition.) For the bicartesian structure of G we have that the operations × and + on objects are both addition of ordinals, the operations × and + on arrows coincide and are deﬁned by the clauses for G(f × g) and G(f + g), and the terminal and the initial object also coincide: they are both the ordinal zero. The category G has zero arrows—namely, the empty relation. The bicartesian category G is a linear category in the sense of [9] (see p. 279). The functor G from B to G is not just a functor, but a bicartesian functor; namely, a functor that preserves the bicartesian structure of B. We also have a functor deﬁned analogously to G, which we call G too, from S to G. It is obtained from the deﬁnition of G above by just rejecting clauses that are no longer applicable. Our aim is to show that the functors G from B and S are faithful.

5

Auxiliary Results

We shall say for a term of B of the form fn ◦ . . . ◦ f1 , for some n ≥ 1, where fi is composition-free, that it is factorized. By using (×2), (+2) and (cat 1) it is easy to show that every term of B is equal to a factorized term of B. A subterm fi in a factorized term fn ◦ . . . ◦ f1 is called a factor. A term of B where all the atomic terms are identities will be called a complex identity. According to (×1), (+1) and (cat 1), every complex identity is equal to an identity. A factor which is a complex identity will be called an identity factor. It is clear that if n > 1, we can omit in a factorized term every identity factor, and obtain a factorized term equal to the original one. A term of B is said to be in K-L normal form iﬀ it is of the form g ◦f : A → B for f a K-term and g an L-term. Note that K-L normal forms are not unique,

86

K. Doˇsen and Z. Petri´c

since (mA ×mA )◦wA+A and mA×A ◦(wA +wA ), which are both equal to wA ◦mA , are both in K-L normal form. We can prove the following proposition for B. K-L NORMALIZATION.

Every term is equal to a term in K-L normal form.

Proof. Suppose f : B → C is a composition-free K-term that is not a complex identity, and g : A → B is a composition-free L-term that is not a complex identity. We show by induction on the length of f ◦ g that (∗) f ◦ g = g ◦ f or f ◦ g = f or f ◦ g = g for f a composition-free K-term and g a composition-free L-term. We shall not consider below cases where g is mB , which are easily taken care of by (m). Cases where f is kB or g is lB are easily taken care of by (k) and (l). The following cases remain. i If f is kC,E and g is g1 × g2 , then we use (k i ). If f is wB , then we use (w). If f is f1 × f2 and g is g1 × g2 , then we use (×2), the induction hypothesis, and perhaps (cat 1). i Finally, if f is f1 + f2 , then we have the following cases. If g is lB , then we 1 ,B2 i use (l ). If g is g1 + g2 , then we use (+2), the induction hypothesis, and perhaps (cat 1). This proves (∗). Every term of B is equal to an identity or to a factorized term fn ◦ . . . ◦ f1 without identity factors. Every factor fi of fn ◦ . . . ◦ f1 is either a K-term or an L-term or, by (cat 1), (×2) and (+2), it is equal to fi ◦ fi where fi is a K-term 1 1 and fi is an L-term. For example, (kA,B × lC,D ) + (wE + lF ) is equal to 1 1 ) + (1E×E ) + lF ) ◦ ((kA,B × 1C ) + (wE + 1O )). ((1A × lC,D

Then it is clear that by applying (∗) repeatedly, and by applying perhaps (cat 1), we obtain a term in K-L normal form. Note that to reduce a term of B to K-L normal form we have used in this proof all the equations of B except (kw1), (kw2), (lm1), (lm2), (kO) and (lI). The deﬁnition of K-L normal form for S is the same. Then the proof above, with some parts omitted, establishes K-L Normalization also for S. We can then prove the following lemma for B and S. LEMMA 5.1. Let f : A1 × A2 → B be a K-term and let G(f ) be nonempty. If for every (x, y) ∈ G(f ) we have x ∈ |A1 |, then f is equal to a term of the form 1 f ◦ kA , and if for every (x, y) ∈ G(f ) we have x − |A1 | ∈ |A2 |, then f is equal 1 ,A2 2 . to a term of the form f ◦ kA 1 ,A2 Proof. We proceed by induction on the length of B. If B is atomic, it can only be a propositional letter, since G(f ) is nonempty. If B is a propositional letter or B1 + B2 , then, by Cut Elimination for K-terms and L-terms, f is equal to a i cut-free Gentzen K-term, which must be equal to a term of the form f ◦ kA . 1 ,A2 The condition on G(f ) dictates whether i here is 1 or 2.

Coherent Bicartesian and Sesquicartesian Categories

87

If B is B1 × B2 , and for every (x, y) ∈ G(f ) we have x ∈ |A1 |, then for i i kB ◦ f : A1 × A2 → Bi , for every (x, z) ∈ G(kB ◦ f ) we have x ∈ |A1 |. So, 1 ,B2 1 ,B2 by the induction hypothesis, i 1 ◦ f = fi ◦ kA , kB 1 ,B2 1 ,A2

and hence

1 2 ◦ f, kB ◦ f f = kB 1 ,B2 1 ,B2 1 = f1 , f2 ◦ kA1 ,A2 .

We reason analogously if for every (x, y) ∈ G(f ) we have x − |A1 | ∈ |A2 |. We can prove analogously the following dual lemma for B and S. LEMMA 5.2. Let f : A → B1 + B2 be an L-term and let G(F ) be nonempty. If for every (x, y) ∈ G(f ) we have y ∈ |B1 |, then g is equal to a term of the form 1 lB ◦ g , and if for every (x, y) ∈ G(f ) we have y − |B1 | ∈ |B2 |, then g is equal 1 ,B2 2 ◦ g . to a term of the form lB 1 ,B2

6

Coherence for Coherent Sesquicartesian Categories

We shall prove in this section that the functor G from S to G is faithful, i.e. we shall show that we have coherence for coherent sesquicartesian categories. These categories are interesting because the category Set of sets with functions, where cartesian product is ×, disjoint union is +, and the empty set is O, is such a category. As a matter of fact, every bicartesian closed category is a coherent sesquicartesian category. A bicartesian closed category is a bicartesian category that is cartesian closed, i.e., every functor A × ... has a right adjoint ...A . And in every cartesian closed category with a terminal object O we have (kO), because Hom(O×O, O) ∼ = Hom(O, OO ). In every cartesian category in which (kO) holds we have that Hom(A, O) is a singleton or empty, because for f, g : A → O we 1 2 have kO,O ◦ f, g = kO,O ◦ f, g (cf. [8], Proposition 8.3, p. 67). The category Set shows that coherent sesquicartesian categories are not max1 imal in the following sense. In the category S the equations lO×A ◦ kO,A = 1O×A 2 and lA×O ◦ kA,O = 1A×O (in which only terms of S occur) don’t hold, but they hold in Set, and Set is not a preorder. That these two equations don’t hold in 1 S follows from the fact that G is a functor from S to G, but G(lO×p ◦ kO,p ) and 2 G(lp×O ◦ kp,O ) are empty, whereas G(1O×p ) and G(1p×O ) contain (0, 0). In the case of cartesian categories and categories with binary products and sums, we had coherence, and used this coherence to prove maximality in [1] and [3]. With coherent sesquicartesian categories, however, coherence and maximality don’t go hand in hand any more. First we prove the following lemmata. LEMMA 6.1.

A constant object of P×,+,O is isomorphic in S to O.

88

K. Doˇsen and Z. Petri´c

Proof. We have in S the isomorphisms 1 2 = kO,O : O × O → O, kO,O mA ◦ (1A + lA ) : A + O → A, mA ◦ (lA + 1A ) : O + A → A,

lO = wO : O → O × O, 1 lA,O : A → A + O, 2 lO,A : A → O + A.

LEMMA 6.2. If f, g : A → B are terms of S and either A or B is isomorphic in S to O, then f = g in S. Proof. Suppose i : A → O is an isomorphism in S. Then from f ◦ i−1 = g ◦ i−1 = lB we obtain f = g. Suppose i : B → O is an isomorphism in S. Then from 1 2 kO,O ◦ i ◦ f, i ◦ g = kO,O ◦ i ◦ f, i ◦ g

we obtain i ◦ f = i ◦ g, which yields f = g. LEMMA 6.3. f = g in S.

If f, g : A → B are terms of S and G(f ) = G(g) = ∅ in G, then

Proof. By K-L Normalization, f = f2 ◦f1 for f1 : A → C a K-term and f2 : C → B an L-term. Since for every z ∈ |C| there is a y ∈ |B| such that (z, y) ∈ G(f2 ), we must have G(f1 ) empty; otherwise, G(f ) would not be empty. On the other hand, if there is a propositional letter in C at the z-th place, there must be for some x ∈ |A| a pair (x, z) in G(f1 ). So C is a constant object of P×,+,O . Analogously, g = g2 ◦ g1 for g1 : A → D a K-term, and g2 : D → B an L-term. As before, D is a constant object of P×,+,O . By Lemma 6.1, there is an isomorphism i : C → D of S, and f = f2 ◦ i−1 ◦ i ◦ f1 . By Lemmata 6.1 and 6.2, we obtain i ◦ f1 = g1 and f2 ◦ i−1 = g2 , from which f = g follows. We shall next prove the following coherence proposition. FAITHFULNESS OF G FROM S. G(g) in G, then f = g in S.

If f, g : A → B are terms of S and G(f ) =

Proof. Lemma 6.3 covers the case when G(f ) = G(g) = ∅. So we assume G(f ) = G(g) = ∅, and proceed by induction on the length of A and B. In this induction we need not consider the cases when either A or B is a constant object; otherwise, G(f ) and G(g) would be empty. So in the basis of the induction, when both of A and B are atomic, we consider only the case when both of A and B are propositional letters. In this case we conclude by Cut Elimination that f and g exist iﬀ A and B are the same propositional letter p, and f = g = 1p in S. (We could conclude the same thing by interpreting S in conjunctive-disjunctive logic.) Note that we didn’t need here the assumption G(f ) = G(g).

Coherent Bicartesian and Sesquicartesian Categories

89

1 1 If A is A1 + A2 , then f ◦ lA and g ◦ lA are of type A1 → B, while 1 ,A2 1 ,A2 2 2 and g ◦ l are of type A → B. We also have f ◦ lA 2 A1 ,A2 1 ,A2 i i ) = G(f ) ◦ G(lA ) G(f ◦ lA 1 ,A2 1 ,A2 i = G(g) ◦ G(lA1 ,A2 ) i = G(g ◦ lA ), 1 ,A2

whence, by the induction hypothesis, i i f ◦ lA = g ◦ lA 1 ,A2 1 ,A2

in S. Then we infer that 1 2 1 2 [f ◦ lA , f ◦ lA ] = [g ◦ lA , g ◦ lA ], 1 ,A2 1 ,A2 1 ,A2 1 ,A2

from which it follows that f = g in S. We proceed analogously if B is B1 × B2 . Suppose now A is A1 × A2 or a propositional letter, and B is B1 + B2 or a propositional letter, but A and B are not both propositional letters. Then, i by Cut Elimination, f is equal in S either to a term of the form f ◦ kA , 1 ,A2 i 1 or to a term of the form lB1 ,B2 ◦ f . Suppose f = f ◦ kA1 ,A2 . Then for every 2 .) (x, y) ∈ G(f ) we have x ∈ |A1 |. (We reason analogously when f = f ◦ kA 1 ,A2 By K-L normalization, g = g2 ◦ g1 in S for g1 : A1 × A2 → C a K-term and g2 an L-term. Since g2 : C → B is an L-term, and hence k i and k don’t occur in it, for every z ∈ |C| we have a y ∈ |B| such that (z, y) ∈ G(g2 ). If for some (x, z) ∈ G(g1 ) we had x ∈ / |A1 |, then for some (x, y) ∈ G(g2 ◦ g1 ) we would have x∈ / |A1 |, but this is impossible since G(g2 ◦ g1 ) = G(g) = G(f ). So for every (x, z) ∈ G(g1 ) we have x ∈ |A1 |. Moreover, G(g1 ) is not empty, since otherwise 1 and G(g) would be empty. Then, by Lemma 5.1, we have that g1 = g1 ◦ kA 1 ,A2 1 g = g2 ◦ g1 ◦ kA1 ,A2 hold in S. 1 ), we can infer from G(f ) = G(g) Because of the particular form of G(kA 1 ,A2 that G(f ) = G(g2 ◦ g1 ), but since f and g2 ◦ g1 are of type A1 → B, by the induction hypothesis we have f = g2 ◦ g1 in S, and hence f = g. When i f = lB ◦ f , we reason analogously and apply Lemma 5.2. 1 ,B2 To verify whether for f, g : A → B in the language of S we have f = g in S it is enough to draw G(f ) and G(g), and check whether they are equal, which is clearly a ﬁnite task. So we have here an easy decision procedure for the equations of S. It is clear that we also have coherence for coherent dual sesquicartesian categories, which are categories with arbitrary ﬁnite products and nonempty ﬁnite sums where (lI) holds. As a consequence of Cut Elimination, of the functoriality of G from B, and of the Faithfulness of G from S, we obtain that S is a full subcategory of B.

7

Coherence for Coherent Bicartesian Categories

We shall ﬁnally prove in this section that the functor G from B to G is faithful, i.e. we shall show that we have coherence for coherent bicartesian categories. But before that we shall give a few examples of coherent bicartesian categories.

90

K. Doˇsen and Z. Petri´c

Note ﬁrst that the bicartesian category Set, where product, sum and the initial object are taken as usual (see the beginning of the previous section), and a singleton is the terminal object I, is not a coherent bicartesian category. The equation (lI) does not hold in Set. Every bicartesian category in which the terminal and the initial object are isomorphic is a coherent bicartesian category. Such is, for instance, the category Set* of pointed sets, i.e. sets with a distinguished element ∗ and ∗-preserving maps, which is isomorphic to the category of sets with partial maps. In Set* the objects I and O are both {∗}, the product × is cartesian product, the sum A + B of the objects A and B is {(a, ∗) : a ∈ A} ∪ {(∗, b) : b ∈ B}, with (∗, ∗) being the ∗ of the product and of the sum, while 1 lA,B (a) = (a, ∗),   a if mA (a, b) = b if  ∗ if

2 lB,A (a) = (∗, a),

a = ∗ b = ∗ a=b=∗

(f + g)(a, b) = (f (a), g(b)). In Set* we have that I+I is isomorphic to I. A fortiori, every bicartesian category in which all ﬁnite products and sums are isomorphic (i.e. every linear category in the sense of [9], p. 279), is a coherent bicartesian category. Such are, for example, the category of commutative monoids with monoid homomorphisms, and its subcategory of vector spaces over a ﬁxed ﬁeld with linear transformations. We shall next present a concrete coherent bicartesian category in which the terminal and the initial object, as well as ﬁnite products and sums in general, are not isomorphic. As coherent sesquicartesian categories were not maximal, so coherent bicartesian categories are not maximal either. This is shown by the category Set*+∅, which is the category of pointed sets extended with the empty set ∅ as an additional object. The arrows of Set*+∅ are the ∗-preserving maps plus the empty maps with domain ∅. Let I be {∗}, let O be ∅, let × be cartesian product, and let the sum A + B be deﬁned as in Set* if either A or B is not ∅. If both A and B are ∅, then A + B is ∅. If A × B and A + B are not ∅, then their ∗ is (∗, ∗), 1 2 as in Set*. Next, let lB be ∅ : ∅ → B, and if A is not ∅, let lA,B , lB,A and mA 1 2 be deﬁned as in Set*. If A is ∅, then lA,B is ∅ : ∅ → ∅ + B, lB,A is ∅ : ∅ → B + ∅ and mA is ∅ : ∅ → ∅. We also have   (f (a), g(b)) if neither f nor g is an empty map (f + g)(a, b) = (f (a), ∗) if f is not an empty map and g is  (∗, g(b)) if g is not an empty map and f is. If f and g are both empty maps, then f + g is the empty map with appropriate codomain. With other arrows and operations on arrows deﬁned in the obvious way, we can check that Set*+∅ is a coherent bicartesian category. In this category we 1 = 1O×A have that ∅×A = A×∅ = ∅. In the category B the equations lO×A ◦kO,A

Coherent Bicartesian and Sesquicartesian Categories

91

2 and lA×O ◦ kA,O = 1A×O (in which only terms of B occur) don’t hold, as we explained at the beginning of the previous section, but they hold in Set*+∅, and Set*+∅ is not a preorder. Note that a coherent bicartesian category C is cartesian closed only if C is a preorder. We have HomC (A, B) ∼ = HomC (I, B A ), and for f, g : I → D with 1 2 (lI) we obtain [f, g] ◦ lI,I = [f, g] ◦ lI,I , which gives f = g. The category Set is cartesian closed, whereas Set* and Set*+∅ are not. We can prove the following lemmata, which extend Lemmata 6.1-6.3.

LEMMA 7.1.

A constant object of P is isomorphic in B to either O or I.

Proof. In addition to the isomorphisms of the proof of Lemma 6.1, we have in B the isomorphisms kI = mI : I + I → I, 1 : A × I → A, kA,I 2 : I × A → A, kI,A

1 2 lI,I = lI,I : I → I + I, (1A × kA ) ◦ wA : A → A × I, (kA × 1A ) ◦ wA : A → I × A.

LEMMA 7.2. If f, g : A → B are terms of B and either A or B is isomorphic in B to O or I, then f = g in B. Proof. We repeat what we had in the proof of Lemma 6.2, and reason dually when A or B is isomorphic to I. LEMMA 7.3. f = g in B.

If f, g : A → B are terms of B and G(f ) = G(g) = ∅ in G, then

Proof. As in the proof of Lemma 6.3, by K-L Normalization, we have f = f2 ◦ f1 for f1 : A → C a K-term, f2 : C → B an L-term, and C a constant object of P; we also have g = g2 ◦g1 for g1 : A → D a K-term, g2 : D → B an L-term, and D a constant object of P. Next we apply Lemma 7.1. If C and D are both isomorphic to O, we reason as in the proof of Lemma 6.3, and we reason analogously when they are both isomorphic to I. If i : C → O and j : I → D are isomorphisms of B, then we have f2 ◦ f1 = g2 ◦ j ◦ kO ◦ i ◦ f1 , by Lemma 7.2, = g2 ◦ g1 , by Lemma 7.2, and so f = g in B. (Note that kO = lI in B.) We can then prove the following coherence proposition. FAITHFULNESS OF G FROM B. G(g) in G, then f = g in B.

If f, g : A → B are terms of B and G(f ) =

Proof. Lemma 7.3 covers the case when G(f ) = G(g) = ∅, and when G(f ) = G(g) = ∅ we imitate the proof of the Faithfulness of G from S in the previous section. As before, this proposition provides an easy decision procedure for the equations of B.

92

K. Doˇsen and Z. Petri´c

References 1. Doˇsen, K., Petri´c, Z.: The Maximality of Cartesian Categories. Math. Logic Quart. 47 (2001) 137-144 (available at: http:// xxx.lanl.gov/ math.CT/ 9911059) 2. Doˇsen, K., Petri´c, Z.: The Maximality of the Typed Lambda Calculus and of Cartesian Closed Categories. Publ. Inst. Math. (N.S.) 68(82) (2000) 1-19 (available at: http:// xxx.lanl.gov/ math.CT/ 9911073) 3. Doˇsen, K., Petri´c, Z.: Bicartesian Coherence. To appear in Studia Logica (available at: http:// xxx.lanl.gov/ math.CT/ 0006052) 4. Gentzen, G.: Untersuchungen u ¨ ber das logische Schließen. Math. Z. 39 (1935) 176210, 405-431. English translation in: The Collected Papers of Gerhard Gentzen. Szabo, M. E. (ed.), North-Holland, Amsterdam (1969) 5. Kelly, G. M., Mac Lane, S.: Coherence in Closed Categories. J. Pure Appl. Algebra 1 (1971) 97-140, 219 6. Lambek, J.: Deductive Systems and Categories I: Syntactic Calculus and Residuated Categories. Math. Systems Theory 2 (1968) 287-318 7. Lambek, J.: Deductive Systems and Categories II: Standard Constructions and Closed Categories. In: Category Theory, Homology Theory and their Applications I. Lecture Notes in Mathematics, Vol. 86. Springer, Berlin (1969) 76-122 8. Lambek, J., Scott, P.J.: Introduction to Higher-Order Categorical Logic. Cambridge University Press, Cambridge (1986) 9. Lawvere, F. W., Schanuel, S. H.: Conceptual Mathematics: A First Introduction to Categories. Cambridge University Press, Cambridge (1997). First edn. Buﬀalo Workshop Press, Buﬀalo (1991) 10. Mac Lane, S.: Natural Associativity and Commutativity. Rice University Studies, Papers in Mathematics 49 (1963) 28-46 11. Simpson, A. K.: Categorical Completeness Results for the Simply-Typed LambdaCalculus. In: Dezani-Ciancaglini, M., Plotkin, G. (eds), Typed Lambda Calculi and Applications (Edinburgh, 1995). Lecture Notes in Computer Science, Vol. 902. Springer, Berlin (1995) 414-427

Indexed Induction-Recursion Peter Dybjer1 and Anton Setzer2 1

2

Department of Mathematics and Computing Science, Chalmers University of Technology. Fax: +46 31 165655. [email protected] Department of Computer Science, University of Wales Swansea, Singleton Park, Swansea SA2 8PP, UK. Fax: +44 1792 295651. [email protected]

Abstract. We give two ﬁnite axiomatizations of indexed inductive-recursive deﬁnitions in intuitionistic type theory. They extend our previous ﬁnite axiomatizations of inductive-recursive deﬁnitions of sets to indexed families of sets and encompass virtually all deﬁnitions of sets which have been used in intuitionistic type theory. The more restricted of the two axiomatization arises naturally by considering indexed inductive-recursive deﬁnitions as initial algebras in slice categories, whereas the other admits a more general and convenient form of an introduction rule. The class of indexed inductive-recursive deﬁnitions properly contains the class of indexed inductive deﬁnitions (so called “inductive families”). Such deﬁnitions are ubiquitous when using intuitionistic type theory for formalizing mathematics and program correctness. A side eﬀect of the present paper is to get compact ﬁnite axiomatizations of indexed inductive deﬁnitions in intuitionistic type theory as special cases. Proper indexed inductive-recursive deﬁnitions (those which do not correspond to indexed inductive deﬁnitions) are useful in intuitionistic metamathematics, and as an example we formalize Tait-style computability predicates for dependent types. We also show that Palmgren’s prooftheoretically strong construction of higher-order universes is an example of a proper indexed inductive-recursive deﬁnition. A third interesting example is provided by Bove and Capretta’s deﬁnition of termination predicates for functions deﬁned by nested recursion. Our axiomatizations form a powerful foundation for generic programming with dependent types by introducing a type of codes for indexed inductive-recursive deﬁnitions and making it possible to deﬁne generic functions by recursion on this type. Keywords: Dependent type theory, Martin-L¨ of Type Theory, inductive deﬁnitions, inductive-recursive deﬁnitions, inductive families, initial algebras, normalization proofs, generic programming.

1

Introduction

In [8], the ﬁrst author introduced the concept of inductive-recursive deﬁnitions, an extension of ordinary inductive deﬁnitions. By inductive-recursive deﬁnitions R. Kahle, P. Schroeder-Heister, and R. St¨ ark (Eds.): PTCS 2001, LNCS 2183, pp. 93–113, 2001. c Springer-Verlag Berlin Heidelberg 2001

94

P. Dybjer and A. Setzer

one can inductively deﬁne a set U while simultaneousely recursively deﬁning a function T : U → D, where D is an arbitrary type. The prime example of an inductive-recursive deﬁnition is a universe, that is, a set U of codes for sets together with a decoding function T : U → set, which assigns to a code in U the set it denotes. As an example consider the constructor introducing codes for the Σ-type. We have Σ : (a : U, b : T (a) → U ) → U Σ (the reader not familiar with this notation, which will be explained in Sec. 2, might temporarily substitute Πa : U.Πb : (T (a) → U ).U for the type of Note that the second argument b of Σ(a, b) refers to T (a). This makes Σ). sense since before Σ(a, b) is introduced, a : U has to be established, and when a : U is established, one can recursively deﬁne T (a). We then deﬁne b)) = Σ(T (a), (x)T (b(x))) (or in more traditional notation recursively T (Σ(a, T (Σ(a, b)) = Σx : T (a).T (b(x))). This is possible, since T (a) and T (b(x)) are b). Here we see the novelty of inductive-recursive known before we introduce Σ(a, deﬁnitions relative to inductive deﬁnitions: an introduction rule for U may refer to the function T which is simultaneously deﬁned. Note that T even can appear However, the connegatively in the type of a constructor, as in the type of Σ. structor refers only strictly positively to elements of the inductively deﬁned set U. In the special case where T : U → 1, where 1 is the type with only one element, so that T does not contain any information, inductive-recursive deﬁnitions specialize to inductive deﬁnitions. For a detailed explanation of the concept of inductive-recursive deﬁnitions, the reader is advised to read the aforementioned article [8]. In [8] the case of indexed inductive-recursive deﬁnitions (IIR) is also considered. In an IIR one deﬁnes a family of sets U (i), indexed over i : I, inductively, while simultaneously recursively deﬁning a family of functions T (i) : U (i) → D[i] for some collection of types D[i] (i : I). (We have to write D[i], the result of substituting i for a ﬁxed variable in D here, since D[i] is a type and we cannot write D : I → type.) Again constructors of U (i) can refer to T (j) applied to elements of U (j). In [9] and [10] we presented closed axiomatizations of the theory of nonindexed inductive-recursive deﬁnitions. It is the objective of this article to extend this to indexed inductive-recursive deﬁnitions. We will see that the resulting rules are not much more complicated than the rules for the non-indexed case. We will look at two alternatives: In restricted IIR (introduced by T. Coquand for use in the Half and Agda [4] systems) we can determine for each index i the set of arguments of the constructors introducing elements of the set Ui . In unrestricted IIR [8], for a constructor C with arguments a, the index i s.t. C(a) : Ui depends on the arguments a of C. Indexed inductive deﬁnitions (IID) subsume inductively deﬁned relations, such as the identity relation understood as the least reﬂexive relation. The identity relation was indeed the only example of an IID in the early versions of Martin-L¨ of type theory [13]. Theoretically, this is not very limiting since one can deﬁne many other families of sets (predicates) using the identity together

Indexed Induction-Recursion

95

with the other set formers of type theory. But from a more practical point of view it became desirable to extend Martin-L¨ of type theory with a general notion of inductive deﬁnition of an indexed family of sets (often called “inductive family” for short) [6,7]. Such a general mechanism is also a key part of the Calculus of Inductive Constructions [21], the impredicative type theory underlying the Coq system. Indexed inductive deﬁnitions are ubiquitous in formalizations carried out in the diﬀerent proof systems for Martin-L¨ of type theory and the Calculus of Inductive Constructions. No proper IIR were part of the original versions of Martin-L¨ of type theory. However, when proving normalization for an early version of this theory, MartinL¨ of made use of an informal construction on the metalevel which has an implicit indexed inductive-recursive character. Plan. In Section 2 we introduce the logical framework of dependent types which is the basis for our theories of IIR. This section also explains the notation used in the paper. In Section 3 we begin by reviewing a few examples of IID, such as ﬁnitely branching trees, the even and odd numbers, the accessible part of a relation, the identity set, and context free grammars. Then we give some examples of proper IIR: Martin-L¨ of’s computability predicates for dependent types, Palmgren’s higher order universes, and Bove and Capretta’s analysis of the termination of nested recursive deﬁnitions of functional programs. We also introduce the restricted form of an inductive-recursive deﬁnition which has an easier syntax and is easier to implement. In Section 4 we ﬁrst explain how the restricted version of indexed inductive-recursive deﬁnitions arises from the existence of initial algebras of strictly positive endofunctors on slice categories over the category of indexed families of types. Then we show how to formalize the general notion of an indexed inductive-recursive deﬁnition and give a uniform theory for both the general and the restricted form by giving a type of codes for IIR and then derive the formation, introduction, elimination and equality rules for a particular code. In Section 5 we show how to instantiate the general theory to some of the examples given in Section 3.

2

The Logical Framework

Before giving the rules for IIR we need to introduce the basic Logical Framework of dependent types. This is essentially Martin-L¨ of’s Logical Framework [18] extended with rules for the types 0, 1, and 2. A more detailed presentation can be found in [10]. The Logcial Framework has the following forms of judgements: Γ context, and A : type, A = B : type, a : A, a = b : A, depending on contexts Γ (written as Γ ⇒ A : type, etc.). We have set : type and if A : set, then A : type. The collection of types is closed under the formation of dependent function types written as (x : A) → B (which is often written as Πx : A.B in the literature – we prefer to reserve Πx : A.B for the inductive-recursively deﬁned set with constructor λ : ((x : A) → B) → (Πx : A.B)). The elements of (x : A) → B are

96

P. Dybjer and A. Setzer

denoted by (x : A)a (abstraction of x in a; this is often denoted by λx : A.a in the literature) and application is written in the form a(b). We have β− and ηrules. Types are also closed under the formation of dependent products written as (x : A)×B (often denoted by Σx : A.B which is here reserved for the inductively deﬁned set with introduction rule p : ((x : A) × B) → (Σx : A.B)). The elements of (x : A) × B are denoted by a, b, the projection functions by π0 and π1 and again we have β and η-rule (surjective pairing). There is the type 1, with unique element : 1 and η-rule expressing that, if a : 1, then a = : 1. Further we have the empty type 0 with elimination rule Efq (ex falsum quodlibet). Moreover, we include in our logical framework the type 2 with two elements 0 : 2 and 1 : 2, ordinary elimination rule C2 : (a : 2, A[0 ], A[1 ]) → A(a) (where x : 2 ⇒ A[x] : type) and the strong elimination rule a:2

A : type

Ctype (a, A, B) 2

B : type : type

with equality rules Ctype (0 , A, B) = A , 2

Ctype (1 , A, B) = B . 2

It is necessary to have the strong elimination rule, since we want to inductively deﬁne indexed families of sets U : I → set and functions T : (i : I) → U (i) → D[i] where D[i] depends non-trivially on i, as in the deﬁnition of Palmgren’s higher-order universe (where for instance D[0] = set, D[1] = Fam(set) → Fam(set), see 3.2 for more explanation). We will also add a level between set and type, which we call stype for small types: stype : type. (The reason for the need for stype is discussed in [8].) If a : set then a : stype. Moreover, stype is also closed under dependent function types, dependent products and includes 0, 1, 2. However, set itself will not be in stype. The logical framework does not have any rules for introducing elements of set, they will be introduced by IIR later and set will therefore consist exactly of the sets introduced by IIR. We also use some abbreviations, such as omitting the type in an abstraction, that is, writing (x)a instead of (x : A)a, and writing repeated application as a(b1 , . . . , bn ) instead of a(b1 ) · · · (bn ) and repeated abstraction as (x1 : A1 , . . . , xn : An )a instead of (x1 : A1 ) · · · (xn : An )a. In the following we will sometimes refer to a type depending on a variable x. We want to use the notation D[t] for D[x := t] for some ﬁxed variable x and D for (x)D[x]. Note that we can’t simply introduce D : I → type, since this goes beyond the logical framework. Instead we introduce the notion of an abstracted expression, which is an expression together with one or several designated free variables. For an abstracted expression E, E[t1 , . . . , tn ] means the substitution of the variables by t1 , . . . , tn . If we take for D above an abstracted expression of the form (x)E, then D[t] denotes D[x := t] and we can write D as parameter for (x)E. More formally:

Indexed Induction-Recursion

97

Deﬁnition 1. (a) An n-times abstracted expression is an expression (x1 , . . . , xn )E where x1 , . . . , xn are distinct variables and E an expression of the language of type theory. An abstracted expression is a 1-times abstracted expression. (b) ((x1 , . . . , xn )E)[t1 , . . . , tn ] := E[x1 := t1 , . . . , xn := tn ]. (c) Whenever we write s[a1 , . . . , an ], s is to be understood as an n-times abstracted expression. (d) If U : A → B, we identify U with the abstracted expression (a)U (a).

3 3.1

Some Examples Indexed Inductive Deﬁnitions

Trees and forests. Many IID occur as the simultaneous inductive deﬁnition of ﬁnitely many sets, each of which has a diﬀerent name. One example is the set of well-founded trees Tree with ﬁnite branching degrees, which is deﬁned together with the set Forest of ﬁnite lists of such trees. The constructors are: tree : Forest → Tree , nil : Forest , cons : Tree → Forest → Forest . If we replace Tree by Tree (0 ) and Forest by Tree (1 ), where x : 2 ⇒ Tree (x) : set, we obtain an IID with index set 2. Since for every index we know the set of constructors introducing elements of it in advance, we have an example of restricted IID. The even number predicate. Another simple example of an IID is the predicate Even : N → set. This is inductively generated by the two rules C0 : Even(0) , C1 : (n : N) → Even(n) → Even(S(S(n))) . In this form we have unrestricted IID, since in this form the constructors introducing an element of Even(n) is not given in advance. The accessible part of a relation. Let I be a set and < : I → I → set be a binary relation on it. We deﬁne the accessible part (the largest well-founded initial segment) of < as a predicate Acc : I → set by a generalized indexed inductive deﬁnition with one introduction rule: acc : (i : I) → ((x : I) → (x < i) → Acc(x)) → Acc(i) . Note that acc introduces elements of Acc(i) while referring to possibly inﬁnitely many elements of the sets Acc(x) (for each x : I and each proof of x < i). Acc is an example of a restricted IID.

98

P. Dybjer and A. Setzer

The identity relation. The only example of an IID in Martin-L¨ of’s original formulation of type theory, which is not an ordinary inductive-recursive deﬁnition is the identity type (“identity type” is only used for historic reason – a more appropriate name would be “identity set”). Assume A : set. The identity on A is given as the least reﬂexive relation on A × A, and is the intensional equality type on A. We have as formation rule a : A, b : A ⇒ I(A, a, b) : set. The introduction rule expresses that it is reﬂexive: r : (a : A) → I(A, a, a) . The elimination rule inverts the introduction rule. Assume we have a type which is a reﬂexive relation on A × A and a subrelation of the identity type on A. So assume a : A, b : A, p : I(A, a, b) ⇒ C[a, b, p] : type and for every a : A we have s[a] : C[a, a, r(a)] (so s is the step-function corresponding to the constructor r). Then for every a, b : A and p : I(A, a, b) we have J(a, b, p, (x)s[x]) : C[a, b, p]. The equality rule now uses the step function in case an element is introduced by a constructor: J(a, a, r(a), (x)s[x]) = s[a]. If we write IA (a, b) instead of I(A, a, b), we obtain for every A : set an unrestricted IID IA with index set A × A. Context free grammars. IID occur very frequently in applications in computer science. For example a context free grammars over a ﬁnite alphabet Σ and a ﬁnite set of nonterminals NT can be seen as an NT × Σ ∗ -indexed inductive deﬁnition L, where each production corresponds to an introduction rule. As an example consider the context free grammar with Σ = {a, b}, NT = {A, B} and productions A −→ a, A −→ BB, B −→ AA, B −→ b. This corresponds to an inductive deﬁnition of an indexed family L, where L(A, α) is the set of derivation trees of the string α from the start symbol A. So α is in the language generated by the grammar with start symbol A iﬀ L(A, α) is inhabited. L has one constructor for each production: C0 : L(A, a), C1 : L(B, α) → L(B, β) → L(A, αβ), C2 : L(A, α) → L(A, β) → L(B, αβ), C3 : L(B, b). Alternatively, we can inductively deﬁne an NT-indexed set D of “abstract syntax trees” for the grammar, and then recursively deﬁne the string d(A, p) (“concrete syntax”) corresponding to the abstract syntax tree p : D(A). In the example given before we get C0 : D(A), C1 : D(B) → D(B) → D(A), C2 : D(A) → D(A) → D(B), C3 : D(B). Further d(A, C0 ) = a, d(A, C1 (p, q)) = d(B, p) ∗ d(B, q), d(B, C2 (p, q)) = d(A, p) ∗ d(B, q), d(B, C3 ) = b. More examples. There are many more examples (eg. the set of formulas derivable in a formal system, computation rules of the operational semantics of a programming language) of similar nature. If Formula is a set of formulas of the formal system, then to be a theorem is given by a Formula-indexed inductive deﬁnition Theorem : Formula → set, where the axioms and inference rules correspond to introduction rules. An element d : Theorem(φ) is a notation for a derivation (or proof tree) with conclusion φ. Yet more examples are provided by the computation rules in the deﬁnition of the operational semantics of a programming language.

Indexed Induction-Recursion

99

Proofs by induction on the structure of an indexed inductive deﬁnition of these kinds are often called proofs by “rule induction”. Thus the general form of rule induction is captured by the elimination rule for unrestricted IIR which we will give later. 3.2

Indexed Inductive-Recursive Deﬁnitions

Martin-L¨ of ’s computability predicates for dependent types. We shall now turn to proper IIR. As a ﬁrst example we shall formalize the Tait-style computability predicates for dependent types introduced by Martin-L¨ of [17]. This example was crucial for the historical development of IIR, since it may be viewed as an early occurrence of the informal notion of an IIR. In [17] Martin-L¨ of presents an early version of his intuitionistic type theory and proves a normalization theorem using such Tait-style computability predicates. He works in an informal intuitionistic metalanguage but gives no explicit justiﬁcation for the meaningfulness of these computability predicates. (Later Aczel [1] has shown how to model a similar construction in classical set theory.) Since the metalanguage is informal the inductive-recursive nature of this deﬁnition is implicit. One of the objectives of the current work is indeed to formalize an extension of Martin-L¨ of type theory where the inductive-recursive nature of this and other deﬁnitions is formalized. In this way we hope to help clarify the reason why it is an acceptable notion from the point of view of intuitionistic meaning explanations in the sense of Martin-L¨ of [14,16,15]. First recall that for the case of the simply typed lambda calculus the Taitcomputability predicates φA are predicates on terms of type A which are deﬁned by recursion on the structure of A. We read φA (a) as “a is a computable term of type A”. To match Martin-L¨ of’s deﬁnition [17] we consider here a version where the clause for function types is – If φB (b[a]) for all closed terms a such that φA (a) then φA→B (λx.b[x]). (Here b[x] denotes an expression with a possible occurrence of the free variable x and b[a] denotes the expression which is obtained by substituting x by a in b[x].) How can we generalize this to dependent types? First we must assume that we have introduced the syntax of expressions for dependent types including Πtypes, with lambda abstraction and application. Now we cannot deﬁne φA for all (type) expressions A but only for those which are “computable types”. The deﬁnition of φA has several clauses, such as the following one for Π [17, p. 161]: 4.1.1.2. Suppose that φA has been deﬁned and that φB[a] has been deﬁned for all closed terms a of type A such that φA (a). We then deﬁne φΠx:A.B[x] by the following three clauses. 4.1.1.2.1. If λx.b[x] is a closed term of type Πx : A.B[x] and φB[a] (b[a]) for all closed terms a of type A such that φA (a), then φΠx:A.B[x] (λx.b[x]). 4.1.1.2.2. . . . 4.1.1.2.3. . . .

100

P. Dybjer and A. Setzer

(We omit the cases 4.1.1.2.2 and 4.1.1.2.3, which express closure under reduction, since they are not relevant for the present discussion. Note also that the complete deﬁnition of the computability predicate also has one case for each of the other type formers of type theory.) We also note that Martin-L¨ of does not use the term “A is a computable type” but only states “that φA has been deﬁned”. We can understand MartinL¨of’s deﬁnition as an indexed inductive-recursive deﬁnition by introducing a predicate Φ on expressions, where Φ(A) stands for “φA is deﬁned” or “A is a computable type”. Moreover, we add a second argument to φ so that φA (p, a) means that “a is a computable term of the computable type A, where p is a proof that A is computable. Now we observe that we deﬁne Φ inductively while we simultaneously recursively deﬁne φ. It would be possible to formalize Martin-L¨ of’s deﬁnition verbatim, but for simplicity we shall follow a slightly diﬀerent version due to C. Coquand [5]. Assume that we have inductively deﬁned the set Exp of expressions and have an operation Apl : Exp → Exp → Exp for the application of one expression to another. Apl is a constructor of Exp, and there will be additional reduction rules for expressions, like reduction of β-redexes. We will write in the following A b for Apl(A, b). Now deﬁne an Exp-indexed IIR Ψ : Exp → set , ψ : (A : Exp) → Ψ (A) → Exp → set . So the index set is Exp, Ψ plays the rˆ ole of U , ψ the rˆ ole of T : (a : U ) → D[a], where D[a] = Exp → set for a : Exp. Note that ψ depends negatively on Ψ , so this is not a simultaneous inductive deﬁnition. The introduction rule for Ψ (corresponding to Martin-L¨ of’s 4.1.1.2) is: π : (A : Exp) → (p : Ψ (A)) → (B : Exp) → (q : (a : Exp) → ψ(A, p, a) → Ψ (B a)) → Ψ (Π(A, B)) . Note that q refers to ψ(A, p, a) which is short notation for ψ(A, p)(a), where ψ(A, p) is the result of the recursively deﬁned function for the second argument p. The corresponding equality rule is ψ(Π(A, B), π(A, p, B, q), b) = ∀a : Exp.∀x : ψ(A, p, a).ψ(B a, q(a, x), b a) . Again, the reader should be aware that we have presented only one crucial case of the complete IIR in [5]. For instance there are clauses corresponding to closure under reductions. Palmgren’s higher-order universes [20]. This construction generalizes Palmgren’s super universe [19], that is, a universe which for any family of sets in it contains a universe containing this family.

Indexed Induction-Recursion

101

It is outside the scope of this paper to give a full explanation of higherorder universes, and the interested reader is referred to Palmgren [20]. They are included here as an example of a proof-theoretically strong construction which is subsumed by our theory of IIR: they are conjectured to reach (without elimination rules into arbitrary types) the strength of Kripke-Platek set theory with one recursive Mahlo ordinal. They also provide an example where we have decoding functions Tk : Uk → D[k] with D[k] = OPk (set) which depend nontrivially on k and, for k > 0, is a higher type which goes beyond set. The higher-order universes of level n is a family of universes Uk , Tk , indexed by k < n, where Uk is a set of codes for operators on families of sets of level k, and Tk : Uk → OPk (set) is the decoding function. The set OPk (set) of such operators is deﬁned by introducing more generally for A : type Fam(A) := (X : set) × (X → A) , Opn (A) := Op(· · · (Op(A)) · · ·) , n

Let

n : N,

Op(A) := Fam(A) → Fam(A) ,

times

Ak : set ,

Bk : Ak → Opk (set)

(k = 0, . . . , n) .

In the following all sets and constructors are parameterized with respect to n, Ak , Bk , but for simplicity we omit those parameters. U0 , T0 have the standard closure properties of a universe. Additionally we have for k = 0, . . . , n the two constructors (with decodings) k ) = Ak , k : U0 , T0 (A A k : Ak → Uk , Tk (B k (a)) = Bk (a) . B Furthermore, under the additional assumptions i ∈ {0, . . . , n − 1}, f : Ui+1 , we have two more constructors (with decodings) ap0i (f ) : (u : U0 , T0 (u) → Ui ) → U0 , T0 (ap0i (f, u, v)) = π0 (Ti+1 (f )(T0 (u), Ti ◦ v)) , ap1i (f ) : (u : U0 , v : T0 (u) → Ui , π0 (Ti+1 (f )(T0 (u), Ti ◦ v))) → Ui , Ti (ap1i (f, u, v, a)) = π1 (Ti+1 (f )(T0 (u), Ti ◦ v))(a) . If we let I := {0, . . . , n} (which more formally should be replaced by Nn+1 ), then we observe that we have introduced U : I → set together with T : (i : I, U(i)) → Di where Di = Opi (set). For each i : I we can determine a collection of constructors, each of which refers strictly positively to U and (positively and negatively) to T applied to the arguments of U referred to. Bove and Capretta’s analysis of the termination of nested recursive deﬁnitions of functional programs. In a recent paper [3], Bove and Capretta use indexed inductive-recursive deﬁnitions in their analysis of the termination of functions

102

P. Dybjer and A. Setzer

deﬁned by nested general recursion. Given such a function f the idea is to simultaneously deﬁne a predicate D(x) expressing that f (x) terminates, and a function f (x, p) which returns the same value as f (x) but has as second argument a proof p : D(x) that f (x) terminates. Assume for instance the rewrite rules f (0) −→ f (f (1)), f (1) −→ 2, f (2) −→ f (1) on the domain {0, 1, 2}. We now inductive-recursively deﬁne the termination predicate D for for f . We get one constructor for each rewrite rule: C0 : (p : D(1), q : D(f (1, p))) → D(0), C1 : D(1), C2 : (p : D(1)) → D(2). Furthermore, the equality rules for f are f (0, C0 (p, q)) = f (f (1, p), q), f (1, C1 ) = 2, f (2, C2 (p)) = f (1, p). This is a proper IIR, since in the type of C0 the second argument depends on f (1, p), where p is the ﬁrst argument. 3.3

Restricted Indexed Inductive-Recursive Deﬁnitions

There are reasons for focussing attention on IIR where we can determine for every index i the set of constructors introducing elements of Ui . More precisely this means that if C is a constructor of the IIR, and we write its type in uncurried form, then its type is of the form ((i : I) × A(i)) → Ui , so the ﬁrst argument determines the index i. An example which satisﬁes this restriction is the accessible part of a relation. We can also determine the set of constructors for Ui , where a constructor has type B → Ui and i does not depend on B, provided the equality on I is decidable. In this case the type of C can be replaced by (i : I) → Ctype (i =dec 2 i , B, 0) → Ui , where =dec is the decidable equality on I, with result in 2). In this way for example ﬁnitely branching trees and forests can be seen to be captured by restricted IIR. In the implementation of the Half proof system of type theory Thierry Coquand enforced this restriction, and it was kept in the Agda system [4], the successor of Half. One reason is that both the introduction and elimination rules can be speciﬁed more simply: for introducing an IIR, the constructors Ci of Uj are just listed in the form data{C1 (a1 ) | · · · | Cn (an )}, and one doesn’t have to include the index j in the arguments of ai of Ci (ai ) – this simpliﬁes the syntax of the system substantially. If one wants to deﬁne g(x) for x : Ui , one can write it in the form case x of {C1 (a1 ) → f1 (an ); ··· Cn (an ) → fn (a); } For deﬁning unrestricted IIR, a more complicated syntax has to be used, especially the elimination rules have to make use of a more general form of pattern matching. See for instance the proof assistant Alf ([12], [2]), where unrestricted IIR can be implemented. Another reason for this restriction is that it is easier to construct mathematical models: below we will see that restricted IIR can be modelled as initial algebras in an I-indexed slice category. Furthermore, domain-theoretic models of restricted IIR can be given more easily. That complications arise when modelling

Indexed Induction-Recursion

103

unrestricted IIR is one of the reasons why many believe that a fully satisfactory understanding of the identity type has not yet been achieved. It is often possible to replace general IIR by restricted IIR, especially if we have a decidable equality on the index set. For example, we can deﬁne a function by recursion which tests equality of natural numbers. Using this equality we can write the introduction rules for the even number predicate in an alternative way: Even(n) holds iﬀ n = 0 or there exists m such that n = S(S(m)) and Even(m). That is, we have two constructors: C0 (n) : (n = 0) → Even(n), and C1 (n) : (m : N) × (n = S(S(m))) × (Even(m)) → (Even(n)). (It is also worth mentioning here that alternatively, we can directly deﬁne the even numbers by primitive recursion on the natural numbers: Even(0) is true and Even(S(n)) is the negation of Even(n), using the two element universe 2 with decoding T : 2 → set.) However, it is not always possible to transform a deﬁnition into the restricted form. The prime example is that of the identity relation. In [11] we however show that if we have extensional equality, we can simulate general IIR by restricted IIR. The deﬁnitions are quite complicated though, and the resulting programs may be computationally ineﬃcient.

4 4.1

Formalizing the Theory of Indexed Inductive-Recursive Deﬁnitions The Category of Indexed Families of Types

As for the non-indexed case, we shall derive a formalization of IIR by modeling them as initial algebra constructions in slice categories. Let R be a set of rules for the language of type theory (where each rule is given by a ﬁnite set of judgements as premisses and one judgement as conclusion) which includes the logical framework used in this article and an equality. For such R let TT(R) be the resulting type theory. The category Type(R) is the category, the objects of which are A s.t. TT(R) proves A : type, and the morphisms from A to B of which are terms f s.t. TT(R) proves f : A → B. Objects A, A such that TT(R) proves A = A : type and functions f, f s.t. TT(R) proves f = f : B → C are identiﬁed. In order to model I-indexed inductive-recursive deﬁnitions, where I is an arbitrary stype, we will use the category Fam(R, I) of I-indexed families of types. An object of Fam(R, I) is an I-indexed family of types, that is, an abstracted expression A for which we can prove i : I ⇒ A[i] : type in TT(R). An arrow from A to B is a I-indexed function, that is, an abstracted expression f for which we can prove (in TT(R)) i : I ⇒ f [i] : A[i] → B[i]. Again we identify A, A s.t. we can prove i : I ⇒ A[i] = A [i] : type and f, f s.t. we can can prove i : I ⇒ f [i] = f [i] : B[i] → C[i]. We will usually omit the argument R in Fam(R, I). If C is a category, D an object of it, then C/D is the slice category with objects pairs (A, f ) where A is an object of C and f an arrow A → D, and as morphisms from (A, f ) to (B, g) morphisms h : A → B s.t. g ◦ h = f . Note

104

P. Dybjer and A. Setzer

that we write pairs with round brackets on this level. This is diﬀerent from the notation a, b for the pair of a and b in the logical framework. General assumption 4.11 In the following we assume in all rules I : stype, i : I ⇒ D[i] : type (D an abstracted expression). 4.2

Coding Several Constructors by One

We can code several constructors of an IIR into one as follows: let J be a ﬁnite index set for all constructors and Aj be the type of the jth constructor. Then replace all constructors by one constructor of type (j : J) → Aj , which is deﬁnable using case distinction on 2. In case of restricted IIR we can obtain one constructor in restricted form with type (i : I, j : J) → Aij → Ci , if the type of the jth constructor is i : I → Aij → Ci . In this way it will suﬃce to consider only IIR with one constructor in the sequel. 4.3

Restricted IIR as Initial Algebras in Slice Categories

Assume we have a restricted IIR with one constructor intro : (i : I) → HU (U, T, i) → U(i) (with all arguments of intro except i in uncurried form), which introduces U : I → set and T : (i : I, U(i)) → D[i]. Here HU : (U : I → set, T : (i : I, U (i)) → D[i], I) → stype with no free occurrences of U , T and i. Let further the equality rule for T be T(i, intro(i, a)) = HT (U, T, i, a) , where HT : (U : I → set, T : (i : I, U (i)) → D[i], i : I, HU (U, T, i)) → D[i] with no free occurrences of U, T, i or a. Now one observes that the introduction rule and equality rule are captured as an I-indexed family of algebras for H in Fam(I)/D, where H(U, T ) = (HU (U, T ), HT (U, T )):1 HU (U, T, i)

intro(i) ✲ U(i)

❅ ❅ ❅ HT (U, T, i) ❅ ❅ ❘

T(i) ❄ D[i]

Note that the situation generalizes the situation for non-indexed inductionrecursion [10], where the rules for U and T are captured as an algebra of an appropriate endofunctor F on the slice category Type/D. 1

To be pedantic: one has to replace H(U, T ), HU (U, T ), HT (U, T ) by uncurried variants U T H ((U, T )), H ((U, T )), H ((U, T ))

Indexed Induction-Recursion

105

If D[i] = 1 and therefore H(U, T, i) does not depend on T , we have the important special case of a restricted indexed inductive deﬁnition. We show the example of the accessible part of a relation: (x : I) → (x < i) → Acc(x)

acc(i) ✲ Acc(i)

❅ ❅ ❅ ! ❅ ❅ ❘

! ❄ 1

i.e. HU (U, T, i) = (x : I) → (x < i) → U (x). 4.4

A Diagram for General IIR

If a particular IIR does not have the restricted form then we do not prima facie know the set of constructors for a particular expression. On the other hand, given an argument to the constructor, we can determine the index of the constructed element. To capture this situation the categorical representation must be changed. Depending on U : I → set and T : (i : I, U (i)) → D[i] we have an stype G U (U, T ) of the arguments of the constructor intro, and, depending on a : G U (U, T ), we have G I (U, T, a) : I, which provides the i s.t. intro(a) : Ui , and G T (U, T, a) : D[G I (U, T, a)], which determines the value of T(i, intro(a)). The diagram is: (a : G U (U, T ))

intro ✲ U (G I (U, T, a))

❅ ❅ T (G I (U, T, a)) ❅ G T (U, T, a) ❅ ❄ ❅ ❘ D[G I (U, T, a)] As a ﬁrst simple instance we look at the identity relation on A. It has index set I := A×A, D[i] = 1, and GU (U, T ) = A, GI (U, T, a) = a, a, and U(a, a) = IA (a, a): (a : A)

r✲

I(a, a)

❅ ❅ ❅ ! ❅ ❅ ❘

! ❄ 1

As a second illustration we show how to obtain the rules for computability predicates for dependent types. (As in Section 3 we only give a deﬁnition containing one case, but the complete deﬁnition [5] can be obtained by expanding the deﬁnition corresponding to the additional constructors).

106

P. Dybjer and A. Setzer

G U (Ψ, ψ) = (A : Exp) × (p : Ψ (A)) × (B : Exp) × ((a : Exp) → ψ(A, p, a) → ψ(B a)) , I

G (Ψ, ψ, A, p, B, q) = Π(A, B) , G T (Ψ, ψ, A, p, B, q) = (b)∀a : Exp.∀x : ψ(A, p, a).ψ(B a, q(a, x), b a) . Note that in the general case we no longer have an endofunctor Fam(I)/D → Fam(I)/D. 4.5

A Uniform Theory for Restricted and General IIR

If we look at the functors arising in general IIR we observe that we have obtained one stype GU (U, T ) and two functions GI (U, T ) : GU (U, T ) → I , GT (U, T ) : (a : GU (U, T )) → D[GI (U, T, a)] . where (U, T ) is an element of Fam(I)/D, GIT (U, T ) := GI (U, T ), GT (U, T ) an element of E := (i : I)×D[i], so (GU (U, T ), GIT (U, T )) is an element of Type/E. This can be expanded to a functor G : Fam(I)/D → Type/E . In restricted IIR we have for i : I HU (U, T, i) : stype , HT (U, T, i) : (a : HU (U, T, i)) → D[i] , which can be combined to an endofunctor (with obvious arrow part and extension to U s.t. i : I ⇒ U [i] : type) H : Fam(I)/D → Fam(I)/D . Consider the functor πi : Fam(I)/D → Type/D[i] with object part πi (U, T ) := (U [i], T [i]) and obvious arrow part. Every element (U, T ) : Fam(I)/D is uniquely determined by its projections πi (U, T ). One also notes that for every sequence of functors Hi : Fam(I)/D → Type/D[i] there exists a unique functor H : Fam(I)/D → Fam(I)/D s.t. πi ◦ H = Hi . H and G will be strictly positive functors in much the same way as F in [10] . But since H is determined by πi ◦ H and both πi ◦ H and G are functors Fam(I)/D −→ Type/E, (where E = (i : I) × D[i] in the general case and E = D[i] in the restricted case), it is more economical to more generally introduce the notion of a strictly positive functor F : Fam(I)/D −→ Type/E for an arbitrary type E. From this we can derive the functors G and H. As in [10], we deﬁne for E : type the type of indices for strictly positive functors E : type , OPI,D,E : type

Indexed Induction-Recursion

107

together with, for γ : OPI,D,E (we omit I, D, E, if the parameter γ is given) FU γ : (U : I → set, T : (i : I, U (i)) → D[i]) → stype , U FT γ : (U : I → set, T : (i : I, U (i)) → D[i], a : F γ (U, T )) → E .

(It is straightforward to deﬁne arrow parts of these functor and the extension to arguments (U, T ) s.t. i : I ⇒ U [i] : type.) We construct elements of OPI,D,E in a similar way as in the non-indexed case: – Base Case: This corresponds to having IIR with no arguments of the constructor and one only has to determine the result of E: ι : E → OPI,D,E , FU (U, T ) =1 , ι(e) FT ι(e) (U, T, ) = e . – Nondependent union of functors: This corresponds to the situation where the constructor has an argument A and (depending on a : A) further arguments coded as γ(a). σ : (A : stype, γ : A → OPI,D,E ) → OPI,D,E , = (a : A) × F U γ(a) (U, T ) ,

FU σ(A,γ) (U, T )

T FT σ(A,γ) (U, T, a, b) = F γ(a) (U, T, b) .

– Dependent union of functors: This corresponds to the situation where the constructor has one inductive argument indexed over A. For each element a : A we have to determine an index i(a) : I, which indicates the set U (i(a)), the inductive argument is chosen from. The result of T for this argument is an element of (a : A) → D[i(a)] and the other arguments depend on this function. Let T ◦ [i, f ] := (x)T (i(x), f (x)). δ : (A : stype, i : A → I, γ : ((a : A) → D[i(a)]) → OPI,D,E ) → OPI,D,E , U FU δ(A,i,γ) (U, T ) = (f : (a : A) → U (i(a))) × F γ(T ◦[i,f ]) (U, T ) , T FT δ(A,i,γ) (U, T, f, b) = F γ(T ◦[i,f ]) (U, T, b) .

We ﬁnish this subsection by drawing a diagram which shows the relationship between the functors G and H for general and restricted IIR: G Fam(I)/D ✲ Type/(i : I) × D[i] ✻ ❅ ❅ H πi ◦ H e ❅ ❅ ❅ ❘ ❄ Type/D[i] ✛ Fam(I)/D πi

108

P. Dybjer and A. Setzer

where e(U, T ) = ((i : I) × U (i), (a)π0 (a), T (π0 (a), π1 (a))). So the functors in the restricted case are those which factor through an endofunctor H, which itself is determined by the “ﬁbers” πi ◦ H. The functors for the restricted case have codes of the form σ(I, (i) · · · δ(A, f, (a) · · · δ(B, g, (b) · · · σ(C, (c) · · · δ(D, (d) · · · ι(i, e)))))) , ie. the codes always start with σ(I, (i) . . . and the innermost parts are of the form ι(i, e) where i is value of the ﬁrst non-inductive argument. (Note that the order of the constructors in an element of OP might depend on arguments preceding them). That a functor G has such a code corresponds exactly to the fact that it is obtained by the above diagram from strictly positive functors πi ◦ H. 4.6

Formation and Introduction Rules for Restricted IIR

Restricted IIR (indicated by a superscript r) are given by strictly positive endofunctors H in the category Fam(I)/D, which can be given by their (strictly positive) projections πi ◦ H : Fam(I)/D → Type/D[i]. So the set of codes for these functors is given as a family of codes for πi ◦ H, and the type of codes is given as OPrI,D : type , OPrI,D = (i : I) → OPI,D,D[i] . Assume now γ : OPrI,D , U : I → set, T : (i : I, U (i)) → D[i], i : I. The object part of H (restricted to U : I → set) is deﬁned as U HU γ (U, T, i) := F γ(i) (U, T ) : stype T HT γ (U, T, i, a) := F γ(i) (U, T, a) : D[i]

for a : H U γ (U, T, i). We have the following formation rules for Urγ and Trγ : Urγ (i) : set ,

Trγ (i) : Urγ (i) → D[i] .

Urγ (i) has constructor r r r introrγ (i) : H U γ (Uγ , Tγ , i) → Uγ (i) ,

and the equality rule for Trγ (i) is: r r Trγ (i, introrγ (i, a)) = H T γ (Uγ , Tγ , i, a) .

4.7

Formation and Introduction Rules for General IIR

In general IIR (as indicated by superscript g) we have to consider strictly positive functors in G : Fam(I)/D → Type/(i : I) × D[i]. The type of codes is given as OPgI,D : type ,

OPgI,D = OPI,D,(i:I)×D[i] .

Indexed Induction-Recursion

109

Assume now γ : OPgI,D , U : I → set, T : (i : I, U (i)) → D[i]. The components of G needed in the following are U GU γ (U, T ) := F γ (U, T ) : stype

G Iγ (U, T, a) := π0 (F T γ (U, T, a)) : I I T GT γ (U, T, a) := π1 (F γ (U, T, a)) : D[G γ (U, T, a)]

for a : G U γ (U, T ). We have essentially the same formation rules for Ugγ and Tgγ Ugγ : I → set ,

Tgγ : (i : I, Ugγ (i)) → D[i] .

There is one constructor for all Ugγ (i). Depending on its arguments G Iγ (Ugγ , Tgγ , a) determines the index it belongs to. So the introduction rule is: g g g I g g introgγ : (a : G U γ (Uγ , Tγ )) → Uγ (G γ (Uγ , Tγ , a)) .

The equality rule for Tgγ is: g g Tg (G Iγ (Ugγ , Tgγ , a), introgγ (a)) = G T γ (Uγ , Tγ , a) .

4.8

Elimination Rules for IIR

We now deﬁne the induction principle both for the restricted and the general map case. We deﬁne ﬁrst more generally F IH for γ : OPI,D,E . Assume F γ and F γ is a twice abstracted expression and γ : OPI,D,E , U : I → set , T : (i : I, U (i)) → D[i] , i : I, u : U (i) ⇒ F [i, u] : type . The rules for F IH and F map are as follows: a : FU γ (U, T ) IH F γ (U, T, F, a) : type

h : (i : I, a : U (i)) → F [i, u] IH F map (U, T, F, h) : (a : F U γ γ (U, T )) → F γ (U, T, F, a)

F IH ι(e) (U, T, F, ) = 1 , F map ι(e) (U, T, F, h, ) = , IH F IH σ(A,γ) (U, T, F, a, b) = F γ(a) (U, T, F, b) , map F map σ(A,γ) (U, T, F, h, a, b) = F γ(a) (U, T, F, h, b) , IH F IH δ(A,i,γ) (U, T, F, f, b) = ((a : A) → F [i(a), f (a)]) × F γ(T ◦[i,f ]) (U, T, F, b) , map F map δ(A,i,γ) (U, T, F, h, f, b) = h ◦ [i, f ], F γ(T ◦[i,f ]) (U, T, F, h, b) .

110

P. Dybjer and A. Setzer

In the restricted case we have now under the assumptions γ : OPrI,D , i : I, a : Urγ (i) ⇒ F [i, a] : type , r r r IH r r h : (i : I, a : H U γ (Uγ , Tγ , i), F γ(i) (Uγ , Tγ , F, a)) → F [i, introγ (i, a)] , Rrγ,F (h) : (i : I, a : Urγ (i)) → F [i, a] , r r Rrγ,F (h, i, introrγ (i, a)) = h(i, a, F map γ(i) (Uγ , Tγ , F, h, a)) . And for the general case we have under the assumptions γ : OPgI,D , i : I, a : Ugγ (i) ⇒ F [i, a] : type , g g g IH g g I g g h : (a : G U γ (Uγ , Tγ ), F γ (Uγ , Tγ , F, a)) → F [G γ (Uγ , Tγ , a), introγ (a)] , Rgγ,F (h) : (i : I, a : Ugγ (i)) → F [i, a] , Rgγ,F (h, G Iγ (Ugγ , Tgγ , a), introgγ (a)) = h(a, F map (Ugγ , Tgγ , F, h, a)) . γ In the restricted case one can show that the above rules express that the family (Urγ (i), Trγ (i)) for i : I is (the carrier of) an initial algebra for the endofunctor H on Fam(I)/D. This generalizes a theorem in [10] about the connection between inductive-recursive deﬁnitions of a set U and a function T : U → D and initial algebras in the slice category Type/D. Deﬁnition 2. (a) The basic theory of indexed inductive recursive deﬁnitions (Bas-IIR) consists of the rules for the logical framework as introduced in this article, the formation and introduction rules for OP and the deﬁning rules for F U , F T , F IH and F map . (b) The theory IIRr of restricted indexed inductive recursive deﬁnitions consists of Bas-IIR, the deﬁning rules for OPr , H U , H T , and the formation/introduction/elimination/equality rules for Ur and Tr . (c) The theory IIRg of general indexed inductive recursive deﬁnitions consists of Bas-IIR, the deﬁning rules for OPg , G U , G I , G T , and the formation/introduction/elimination/equality rules for Ug and Tg . (d) IIDr and IIDg are the restrictions of IIRr and IIRg , where in all rules in this article D[i] = 1. These are the theories of restricted and general indexed inductive deﬁnitions.

5

The Examples Revisited

We ﬁrst introduce the following abbreviations: γ +OP γ := σ(2, (x)C2 (x, γ, γ )) and γ1 +OP · · · +OP γn := (· · · ((γ1 +OP γ2 ) +OP γ3 ) +OP · · · +OP γn ) if n ≥ 3.

Indexed Induction-Recursion

111

So if γ1 , . . . , γn are codes for constructors Ci then γ1 +OP · · · +OP γn is a code for a constructor C. The ﬁrst argument of C codes an element i of {1, . . . , n}. The later arguments of C are the arguments of the constructor Ci . In the following (−) stands for an abstraction (x) for a variable x, which is not used later. Let ιg (a) := ι(a, ), ιr := ι(). – The trees and forests have code γ : OPr2,(−)1 (= 2 → OP2,(−)1,1 ), where γ(0 ) = δ(1, (−)1 , (−)ιr ) , γ(1 ) = ιr +OP δ(1, (−)0 , (−)δ(1, (−)1 , (−)ιr )) . Then Tree = Ur2,(−)1,γ (0 ), Forest = Ur2,(−)1,γ (1 ). – The even number predicate has code ιg (0) +OP σ(N, (n)δ(1, (−)n, (−)ιg (S(S(n))))): OPgN,(−)1 (= OPN,(−)1,N×1 ) . – The accessible part of a relation has code (i)δ((x : I) × (x < i), (z)π0 (z), (−)ιr ): OPrI,(−)1 (= (i : I) → OPI,(−)1,1 ) . As a general IIR it has code σ(I, (i)δ((x : I) × (x < i), (z)π0 (z), (−)ιg (i))): OPgI,(−)1 (= OPI,(−)1,I×1 ) . – The identity set has code σ(A, (a)ιg (a, a)) : OPgA×A,(−)1 (= OPA×A,(−)1,(A×A)×1 ) . – For the Tait-style computability predicates for dependent types we have I = Exp, D[i] = Exp → set. The rules given in Subsection 3.2 are incomplete, additional constructors have to be added by using +OP (the current deﬁnition actually deﬁnes the empty set). The code for the constructor given in Subsection 3.2 is σ(Exp, (A) δ(1, (−)A, (ψA ) σ(Exp, (B) δ((a : Exp) × ψA (, a), (y)(B π0 (y)), (ψB ) ι(Π(A, B), (b)∀a : Exp.∀x : ψA (, a).ψB (a, x, (b a))))))) : OPgI,(i)D[i] (= OPI,(i)D[i],(i:I)×D[i] ) . – E. Palmgren’s higher order universe has code γ : OPr{0,...,n},(l)Opl (set) (= (k : {0, . . . , n}) → OP{0,...,n},(l)Opl (set),Opk (set) ) , where γ(0) := γUniv +OP γA 0 +OP · · · +OP γA n +OP γB 0 +OP γap00 +OP γap01 +OP · · · +OP γap0n +OP γap10 , (i = 1, . . . , n − 1) , γ(i) := γB i +OP γap1i γ(n) := γB n .

112

P. Dybjer and A. Setzer

and γUniv is a code for all standard universe constructors, γA k := ι(Ak ) , γB k := σ(Ak , (a)ι(Bk (a))) , γap0i := δ(1, (−)(i + 1), (Tf ) δ(1, (−)0, (Tu ) δ(Tu (), (−)i, (Tv ) ι(π0 (Tf (, Tu (), Tv )))))) , γap1i := δ(1, (−)(i + 1), (Tf ) δ(1, (−)0, (Tu ) δ(Tu (), (−)i, (Tv ) σ(π0 (Tf (, Tu (), Tv )), (a) ι(π1 (Tf (), Tu (), Tv )(a)))))) . (To be formally correct we would have to work with Nn+1 instead of {0, . . . , n}).

6

Further Results

There is an extended version [11] of this article which contains some additional topics. In particular we show the consistency of our theories by constructing a model in classical set theory where type-theoretic function spaces are interpreted as full set-theoretic function spaces, and some axioms for large cardinals are used for interpreting the type of sets closed under IIR and also to interpret the logical framework. This construction is a generalization of the model for non-indexed induction-recursion given in [9]. Furthermore, we show that the restricted and general form of an IIR are intertranslatable under certain conditions. We also show how to simulate certain forms of IIR by non-indexed inductive-recursive deﬁnitions (IR).

References 1. P. Aczel. Frege Structures and the Notions of Proposition, Truth, and Set, pages 31–59. North-Holland, 1980. 2. T. Altenkirch, V. Gaspes, B. Nordstr¨ om, and B. von Sydow. A user’s guide to ALF. http://www.www.cs.chalmers.se/ComputingScience/Research/ Logic/alf/guide.html, 1996. 3. A. Bove and V. Capretta. Nested general recursion and partiality in type theory. To appear in the Proceedings of TPHOL 2001. 4. C. Coquand. Agda. 2000. http://www.cs.chalmers.se/ catarina/agda/. 5. C. Coquand. A realizability interpretation of Martin-L¨ of’s type theory. In G. Sambin and J. Smith, editors, Twenty-Five Years of Constructive Type Theory. Oxford University Press, 1998.

Indexed Induction-Recursion

113

6. P. Dybjer. Inductive sets and families in Martin-L¨ of’s type theory and their settheoretic semantics. In G. Huet and G. Plotkin, editors, Logical Frameworks, pages 280–306. Cambridge University Press, 1991. 7. P. Dybjer. Inductive families. Formal Aspects of Computing, 6:440–465, 1994. 8. P. Dybjer. A general formulation of simultaneous inductive-recursive deﬁnitions in type theory. Journal of Symbolic Logic, 65(2), June 2000. 9. P. Dybjer and A. Setzer. A ﬁnite axiomatization of inductive-recursive deﬁnitions. In J.-Y. Girard, editor, Typed Lambda Calculi and Applications, volume 1581 of Lecture Notes in Computer Science, pages 129–146. Springer, April 1999. 10. P. Dybjer and A. Setzer. Induction-recursion and initial algebras. Submitted for publication, April 2000. 11. P. Dybjer and A. Setzer. Indexed induction-recursion. To appear as a Report of Institut Mittag-Leﬄer, 2001. 12. L. Magnusson and B. Nordstr¨ om. The ALF proof editor and its proof engine. In Types for proofs and programs, volume 806 of Lecture Notes in Computer Science, pages 213–317. Springer, 1994. 13. P. Martin-L¨ of. An intuitionistic theory of types: Predicative part. In H. E. Rose and J. C. Shepherdson, editors, Logic Colloquium ‘73, pages 73–118. North-Holland, 1975. 14. P. Martin-L¨ of. Constructive mathematics and computer programming. In Logic, Methodology and Philosophy of Science, VI, 1979, pages 153–175. North-Holland, 1982. 15. P. Martin-L¨ of. On the meaning of the logical constants and the justiﬁcation of the logical laws, 1983. Notes from a series of lectures given in Siena. 16. P. Martin-L¨ of. Intuitionistic Type Theory. Bibliopolis, 1984. 17. P. Martin-L¨ of. An intuitionistic theory of types. In G. Sambin and J. Smith, editors, Twenty-Five Years of Constructive Type Theory. Oxford University Press, 1998. Reprinted version of an unpublished report from 1972. 18. B. Nordstr¨ om, K. Petersson, and J. Smith. Programming in Martin-L¨ of ’s Type Theory: an Introduction. Oxford University Press, 1990. 19. E. Palmgren. On Fixed Point Operators, Inductive Deﬁnitions and Universes in Martin-L¨ of ’s Type Theory. PhD thesis, Uppsala University, 1991. 20. E. Palmgren. On universes in type theory. In G. Sambin and J. Smith, editors, Twenty-Five Years of Constructive Type Theory. Oxford University Press, 1998. 21. C. Paulin-Mohring. Inductive deﬁnitions in the system Coq - rules and properties. In Proceedings Typed λ-Calculus and Applications, pages 328–245. Springer-Verlag, LNCS, March 1993.

Modeling Meta-logical Features in a Calculus with Frozen Variables Birgit Elbl Institut f¨ ur Theoretische Informatik und Mathematik, Fakult¨ at f¨ ur Informatik, UniBw M¨ unchen, 85577 Neubiberg, Germany [email protected]

Abstract. We consider logic programming computations involving meta-logical predicates and connectives. The meaning of these elements depends on structural properties of the arguments, e.g. being an uninstantiated variable or a ground term when the goal is called, or involve success / failure conditions for the components which relates them to control. To model these eﬀects we use a substructural calculus and introduce a binding mechanism at the level of sequents called freezing. Keywords: logic programming, substructural logic, control

1

Introduction

In logic programming the basic data structure is the algebra of terms where terms need not be ground but may contain variables. A predicate takes terms as arguments and in case of a successful evaluation substitutions for their variables are returned. The substituted terms usually contain still variables which may be instantiated by further subcomputations. In this setting tests for the property of being a variable or ground or a procedure to produce a ‘fresh’ variant of a term seem quite natural primitives. They are, however, usually classiﬁed as ‘meta-logical’, as variables are no longer ‘logical’ in the sense that they are just representing all (ground) instances but turn into objects in their own right. An axiomatization should take this into account. A calculus for deriving statements concerning the results which enjoys the substitution property can not treat these expressions as variables, as e.g. var(x) succeeds, although no ground instance does, ground(x) fails, although no ground instance does etc. A similar phenomenon occurs when considering additional connectives. The arguments of the connectives are goals, usually with variables. It is quite natural to accept here conditions on success or failure of the goal “as it is” but then variables change their status: the success of a goal does not imply success of all its instances, the failure of the test for failing of a goal does not imply that this is the case for all instances etc. Note that, although these features belong to the ‘control’ group, their meaning can be easily explained as a function on results without referring to operational details. Hence it seems appropriate to ask for a proof-theoretic description. R. Kahle, P. Schroeder-Heister, and R. St¨ ark (Eds.): PTCS 2001, LNCS 2183, pp. 114–129, 2001. c Springer-Verlag Berlin Heidelberg 2001

Modeling Meta-logical Features in a Calculus with Frozen Variables

115

A possible solution is a deductive system in the style of [11,9]. There not and cut have already been considered. Program variables just are no longer ‘logical’ in the sense above. Here we try a diﬀerent route: we want to keep free variables in general, serving to describe uniﬁcation and value passing in terms of equality axioms and substitution and to further compositional descriptions of the ordinary connectives, as these do involve judgments about all instances. The compromise investigated here is to introduce a binding mechanism at the level of sequents, not connected with introducing a logical symbol and turning a variable in a state between ‘free’ and ‘special constant’. We do not request the substitution property for these variables but with respect to rule application they are treated as variables. They can be turned into regular bound variables by quantiﬁcation. The term ‘frozen’ is chosen to emphasize that they loose their ability to vary and also to resemble the ‘freeze’ mechanism sometimes considered in extensions (see [12] for a discussion of this feature and meta-logical predicates in general) where also variables are turned into true objects. In contrast to this approach, however, the frozen variables here do not behave like constants. In the sequel we proceed as follows: ﬁrst we introduce the calculus with frozen variables and formulate axioms and rules for meta-logical features, then we present a model based on streams of answers and show the soundness of the calculus w.r.t. this interpretation. In order to relate it to a procedural interpretation we present an operational semantics of the language with meta-logical features and show how successful and failing computations can be mapped to derivations of the corresponding judgment.

2 2.1

A Calculus with Frozen Variables Introducing Frozen Variables

We presuppose ﬁxed sets var of variables, and predn of n-ary predicate symbols. Further basic symbols are given by a signature Σ. The expressions are either (object) terms or goals, also referred to as expressions of sort ι or o respectively. The signature consists of constructor symbols c: ιn −→ ι to ﬁx the term algebra, symbols b: ιn −→ o for ‘built-in’ predicates and connectives ◦: on −→ o. The latter include 1, F, 0: o and ⊗, ∗: o × o −→ o for which we use inﬁx notation. Terms (of type ι) are built from variables and constructor symbols as usual. Deﬁnition 1. The set of goals is inductively deﬁned by: – 1, F, 0 are goals, and p(t¯) is a goal if p is an n-ary predicate symbol or built-in p: ιn −→ o and t¯ = t1 , . . . , tn are terms. – If G1 , . . . , Gn are goals and ◦: on −→ o then ◦(G1 , . . . , Gn ) is a goal. If G is a goal and x is a variable then ExG is a goal. ¯ = x1 , . . . , xn are pairwise distinct A goal E¯ u(¯ x = t¯) where t¯ = t1 , . . . , tn , and x variables that do not occur in t¯ or u ¯ is called positive answer. If Γ and ∆ are ﬁnite lists of goals and d is a ﬁnite set of variables then Γ ⇒d ∆ is a sequent.

116

B. Elbl

The quantiﬁer Ex binds the mentioned variable. In the sequel goals that are equal up to bound renaming are identiﬁed. The notation fv is used to refer to the set of free variables, and t¯ = s¯ is a shorthand for t1 = s1 ⊗ . . . ⊗ tn = sn if t¯ = t1 , . . . , tn and s¯ = s1 , . . . , sn . In a sequent Γ ⇒d ∆ the variables in d are frozen. Although there is no binding construction in the formulas, these variables are not treated as regular free variables: if x is frozen, we do not expect that the derivability of Γ ⇒d ∆ implies the derivability of Γ {t/x} ⇒d ∆{t/x}. Equality is used for uniﬁcation (with occur check), ⊗ for goal conjunction, ∗ for disjunction. The constant F corresponds to fail, 1 to a prolog atom deﬁned by 1., 0 to a prolog atom deﬁned by 0 :− 0. The name “positive answer” reﬂects the fact that these goals represent answer substitutions. Sequents Γ ⇒d ∆ are derived in a substructural calculus Kfrz . Similar to linear logic [7] the calculus Kfrz has no weakening and contraction rules. All connectives used here are multiplicatives and non-commutative. In contrast to linear logic the multiplicatives are not dual to each other. Furthermore, the quantiﬁer is not standard. The calculus Kfrz [∅] is obtained from a fragment of the calculus LPC+ used in [4] to deﬁne a declarative semantics for pure prolog+negation which is suﬃcient for deﬁnite programs by adding frozen variables. There is no universal quantiﬁcation but it is understood that whenever we formulate an axiom we want to accept every instance resulting by substitution for non-frozen free variables and renaming frozen ones as an axiom. There is no implication but the “top-level” implication corresponding to the sequent arrow. The notation G ⇔d H is used to refer to the sequents G ⇒d H and H ⇒d G. An inference rule with premises S1 , . . . , Sn (n ≥ 0) and conclusion S is written S1 , . . . , Sn S. Deﬁnition 2. The axioms and rules of the calculus Kfrz [∅] are as follows: 1. identity and structural: G ⇒d G, and (Γ ⇒d G), (G ⇒e ∆) Γ ⇒d∪e ∆, and Γ ⇒d ∆ Γ ⇒d∪e ∆ 2. propositional connectives: 0, Γ ⇒d ∆ Γ, G1 , G2 , Π ⇒d ∆ Γ, G1 ⊗ G2 , Π ⇒d ∆ (G1 ⇒d ∆), (G2 ⇒e Σ) G1 ∗ G2 ⇒d∪e ∆, Σ (Γ ⇒d G1 ), (Π ⇒e G2 ) Γ, Π ⇒d∪e G1 ⊗ G2 if e ∩ fv(Γ ) = ∅ Γ ⇒d ∆, G1 , G2 , Σ Γ ⇒d ∆, G1 ∗ G2 , Σ Γ, Π ⇒d ∆ Γ, 1, Π ⇒d ∆, and ⇒d 1

F ⇒d , and Γ ⇒d ∆, Σ Γ ⇒d ∆, F, Σ

F ⇒d F ⊗ G, and (G1 ⊗ H) ∗ (G2 ⊗ H) ⇒d (G1 ∗ G2 ) ⊗ H 3. quantiﬁcation Γ, G1 , Π ⇒d ∆ Γ, ExG1 , Π ⇒d\{x} ∆ !(x) Γ, G1 , Π ⇒d G2 Γ, ExG1 , Π ⇒d\{x} ExG2 !(x) Γ, Π ⇒d G2 Γ, Π ⇒d\{x} ExG2 !(x)

ExEyG ⇒d EyExG 4. mixed:

ExG1 ∗ ExG2 ⇒d Ex(G1 ∗ G2 )

Ex(G1 ⊗ G2 ) ⇒d ExG1 ⊗ G2 !(x)

Ex(G1 ⊗ G2 ) ⇒d G1 ⊗ ExG2 !(x)

Modeling Meta-logical Features in a Calculus with Frozen Variables

117

5. equality: (=1 ) t = t ⇔d 1 (=2 ) t = s ⇔d s = t (=3 ) x = t ⇔d F if x occurs in t but x ≡ t (=4 ) f (t¯) = g(¯ s) ⇔d F if f ≡ g d ¯ (=5 ) t = s¯ ⇔ f (t¯) = f (¯ s) (=6 ) x = t ⊗ A ⇔d x = t ⊗ A{t/x} (C= ) t = s ⊗ t = s ⇔d t = s ⊗ t = s (D= )t = s ⊗ (A ∗ B) ⇔d (t = s ⊗ A) ∗ (t = s ⊗ B) (F= ) t = s ⊗ F ⇔d F (E/ =) Ex(x = t) ⇔d 1 if x does not occur in t or t ≡ x (⊗/ =) G ⇒d H x = t, G ⇒d∪{x} x = t ⊗ H if x ∈ d Here G1 , G2 , G, H are arbitrary formulas, Γ, Π, ∆, Σ ﬁnite lists of formulas, d, e ﬁnite sets of variables, and !(x) stands for the eigenvariable condition: x must not occur free in the conclusion. All axioms and rules are correct w.r.t. a classical interpretation, ignoring the variable set attached to the sequent arrow. The only rules subject to a condition on the additional set of variables are (⇒ ⊗) and (⊗/ =). Variables are removed from this set (‘melted’) only in the (E) rules. Note that in all cases the melted variable occurs only bound in the conclusion. Hence frozen variables are not turned into free variables. The axioms (=1 ) − (=6 ) are appropriate versions of Clark’s equality axioms. In (C= ), (D= ), (F= ) laws are formulated for equality which hold no longer in general. These axioms have been used already in the version without frozen variables. In a similar way we added now (⊗/ =): without frozen variables it is derivable using the ⊗-rule, now it is no longer admissible for arbitrary formulas but we add it for equations. In this presentation the general axioms and rules are separated from those determined by a speciﬁc extension but obviously the frozen variables are superﬂuous if nothing further is added: then Γ ⇒d ∆ for some d implies Γ ⇒e ∆ for every e. 2.2

Modeling Meta-logical Features

First we consider some predicates for structure inspection and manipulation. Deﬁnition 3. Let Σstruct be the signature which contains additional predicate symbols var, ground: ι −→ o and copy: ι × ι −→ o. The set Tstruct consists of: ⇒d∪{x} var(x) F ⇒d var(c(¯ x)) for c: ιn −→ ι ground(x1 ), . . . , ground(xn ) ⇒d ground(c(x1 , . . . , xn )) for c: ιn −→ ι F ⇒d∪{x} ground(x) x}, {¯ u/¯ x}a renaming, E¯ u(s = t{¯ u/¯ x}) ⇒d∪{¯x} copy(t, s) where fv(t) = {¯ and fv(s) ∩ {¯ u} = ∅

118

B. Elbl

To demonstrate the eﬀect of copy consider the following way to deﬁne a test for the variable property in presence of two distinct constants c, d: v(t) :≡ EuEv(copy(t, u) ⊗ copy(t, v) ⊗ u = c ⊗ v = d) Then Kfrz [Tstruct ] ⇒{x} v(x) and Kfrz [Tstruct ] F ⇒{¯x} v(f (¯ x)). The second group consists of connectives which depend on a simple condition on the result for their arguments. Deﬁnition 4. Let Σcond be the signature which contains additional connectives fail if, succeed if, once, and ( · → ·; ·). The set Tcond consists of: F ⇒d G ⇒d fail if(G) A ∗ 0 ⇒d G F ⇒d∪efail if(G) where fv(G, A) = e and A is a positive answer F ⇒d G F ⇒d succeed if(G) A ∗ 0 ⇒d G ⇒d∪esucceed if(G)where fv(G, A) = e and A is a positive answer F ⇒d G F ⇒d once(G) A ∗ 0 ⇒d G A ⇒d∪e once(G) where fv(G, A) = e and A is a positive answer G ⇒d H fail if(G) ⇒d fail if(H) G ⇒d H succeed if(G) ⇒d succeed if(H) G ⇒d H once(G) ⇒d once(H) (F ⇒d G), (Γ ⇒e H2 ) Γ ⇒d∪e (G → H1 ; H2 ) (A ∗ 0 ⇒d1 G),(Γ ⇒d2 H1 ) A, Γ ⇒d1 ∪d2 ∪e (G → H1 ; H2 ) where A is a positive answer, fv(A) ∩ d2 = ∅, and fv(G, A) = e d

(G ⇒ G ), (H1 ⇒e1 H1 ), (H2 ⇒e2 H2 ) (G → H1 ; H2 ) ⇒d∪e1 ∪e2 (G → H1 ; H2 ) if fv(G) ∩ e1 = ∅.

The signature Σ and the theory TΣ determine a language. Programs are sets of recursive predicate deﬁnitions in this language. Deﬁnition 5. A predicate deﬁnition is a sequent DefP x) ⇒ p(¯ x) where DefP x) p (¯ p (¯ is a goal, p is in predn , and x ¯ = x1 , . . . , xn are pairwise distinct variables containing the free variables in DefP x). A program is a ﬁnite set of predicate p (¯ deﬁnitions containing for every predicate name at most one deﬁnition. A sequent is derivable in Kfrz [T ] ( T = ∅ or T = Tstruct or T = Tcond or T = Tstruct ∪ Tcond ) from P if it is deducible using the axioms and rules in d ¯ ¯ Kfrz [∅] and T and axioms DefP p (t) ⇒ p(t) which are obtained by substitution (and bound renaming if necessary) from elements in P . Derivability of Γ ⇒d ∆ in Kfrz [T ] from P is denoted by (Kfrz [T ], P ) Γ ⇒d ∆. The notation Kfrz [T ] Γ ⇒d ∆ is used for (Kfrz [T ], ∅) Γ ⇒d ∆. Lemma 6. Let T = ∅ or T = Tstruct or T = Tcond or T = Tstruct ∪ Tcond . x} is a Let Γ ⇒{¯x} ∆ be a sequent and θ a substitution so that θ restricted to {¯ renaming and no variable xi θ occurs in any term yθ where y ≡ xi . If (Kfrz [T ], P ) Γ ⇒{¯x} ∆ then (Kfrz [T ], P ) Γ θ ⇒{¯xθ} ∆θ.

Modeling Meta-logical Features in a Calculus with Frozen Variables

119

Proof. Induction on the height of the derivation. Here we assume that bound variables in Γ, ∆ are renamed if necessary for the application of θ. The second condition on θ serves a similar purpose: the unintended freezing of variables in substituted terms is avoided. For example, if c is a constant then Kfrz [Tstruct ] y = c ⇒{x} y = c ⊗ var(x) but Kfrz [Tstruct ] x = c ⇒{x} x = c ⊗ var(x). For deﬁned predicates we added only an implication as axiom. This is suﬃcient for deriving success statements, also including failure. Here failure is formalized by F ⇒d G, hence by an expression in which G occurs positive. In order to strengthen the power concerning general statements one could add fur¯ ther axioms p(t¯) ⇒d DefP p (t). An alternative axiomatization could be based on P ¯ d d d ¯ ¯ rules (Γ ⇒ Defp (t)) (Γ ⇒d p(t¯)) and (DefP p (t) ⇒ ∆) (p(t) ⇒ ∆), x) ≡ ∗m u(i) (¯ x = s¯(i) ⊗ (⊗ Πi )) (where or for prolog-style deﬁnitions DefP p (¯ i=1 E¯ (i) (i) (i) {¯ x} ∩ {¯ u } = ∅, fv(¯ s , Πi ) = {¯ u} , and Πi contains only atomic formulas): (Γ ⇒d E¯ u(1) (t¯ = s¯(1) ⊗ (⊗ Π1 )), . . . , E¯ u(m) (t¯ = s¯(m) ⊗ (⊗ Πm ))) Γ ⇒d p(t¯) (i) ¯ (i) (E¯ u (t = s¯ ⊗ (⊗ Πi )) ⇒ ∆i )i=1,...,m p(t¯) ⇒ ∆1 , . . . , ∆m with the usual condition on variables. More in the style of the calculus with deﬁnitional reﬂection in [10] is the version (Γ ⇒d E¯ u(i1 ) (ˆ σ1 ⊗ (⊗ Πi1 σ1 )), . . . , E¯ u(ik ) (ˆ σk ⊗ (⊗ Πik σk ))) Γ ⇒d p(t¯) (iν ) d (E¯ u (ˆ σν ⊗ (⊗ Πσν )) ⇒ ∆ν )ν=1,...,k p(t¯) ⇒d ∆1 , . . . , ∆k where i1 , . . . , ik are the numbers of clauses with a head that uniﬁes with p(t¯), σν the mgu and σ ˆν is a representing formula for σν . Note, however, that it is necessary to include σ ˆν even in the second rule to avoid unsound inferences. To see this, consider as an example the clauses ((p(c) : − q(d)); q(d).). Using the rules above one could derive q(d) ⇒ 1, hence x = c ⊗ q(d) ⇒ x = c, and ﬁnally p(x) ⇒ x = c. To infer p(x) ⇒ 1 would be wrong as p(d) ⇒ 1 is no consequence. Also for the basic connectives as well as for the conditional group in Σcond one could add further axioms. The test they would have to pass is the semantics in Sec.3. In the version above we only have some rules concerning results and for each connective in Σcond a rule expressing monotonicity. The rule for (· → ·; ·) and one of the rules for ⊗, however, are subject to conditions on the free and frozen variables. Hence, although all connectives are positive, the derivability of G ⇒d H does not imply derivability of C[G] ⇒d∪e(C) C[H] (for e(·) still to be deﬁned) for arbitrary contexts C. The rule (G ⇒d H) (A⊗G ⇒d A⊗H) would even lead to unsound inferences as can be exempliﬁed by G ≡ 1, H ≡ var(x), d = {x}, A ≡ (x = c). For a speciﬁc class of contexts this monotonicity property does hold and this will be proved and used in Sec. 4.2 where the calculus is related to an operational semantics.

120

3 3.1

B. Elbl

Semantics Preliminaries

For the semantics, domains and operations are used which have been introduced in [4] and used in a denotational semantics for pure prolog. Fixed point semantics have been suggested before, see [8],[3],[1]. In the sequel all necessary ingredients are presented brieﬂy (without any proofs). For more details the reader is referred to [4], Sections 2 and 5.1, and [6] (for G, P and the extension to control). The original application is a semantics for pure prolog. Here we turn things round, consider the domains as given and ask for ways to describe their elements and operations on them. Nevertheless, although the programming language prolog is not used here, some general concepts of it motivate the deﬁnitions. The arguments for a predicate are terms t¯ and we assume an evaluation that produces substitutions θ for the variables in t¯. A ﬁnite set {t1 /x1 , . . . , tn /xn }, where x1 , . . . , xn are distinct variables and t1 , . . . , tn are terms, is called ﬁnite substitution. Similar to [3], this notion of ﬁnite substitution takes into account the domain: We allow bindings x/x in a substitution and distinguish between θ and θ ∪ {x/x}. The presence of a variable x in a substitution θ implies that x is not just an auxiliary variable. The choice of auxiliary variables should be irrelevant, hence {f (x)/y} equivalent to {f (u)/y} if considered as answers for a goal ?− p(v, y). But considered as answers for a goal ?− p(x, y) they are essentially diﬀerent: the ﬁrst states a relation between the arguments, the second doesn’t. This diﬀerence is reﬂected in the domain of variables: If we want to state the relation between x and y we use the substitution {f (x)/y, x/x}, equivalently {f (u)/y, u/x}, otherwise {f (u)/y}, equivalently {f (x)/y}. Using the relation ∼, we abstract further from syntactic properties, concentrating on the fact whether a condition involving a variable x is produced or not, identifying the situations where this is due to the fact that x does not occur in the goal or the speciﬁc predicate deﬁnition. Let FSubst be the set of ﬁnite substitutions. Elements of FSubst are denoted by θ, σ, δ, ρ, possibly indexed, or explicitly by {t¯/¯ x}. The domain and the set of variables in the range are deﬁned by Dom({t¯/¯ x}) = {¯ x} and Rg({t¯/¯ x}) = var(t1 ) ∪ . . . ∪ var(tn ). For every ﬁnite set d of variables, FSubstd denotes the set of ﬁnite substitutions with domain d. If y¯ = y1 , . . . , yn are distinct variables, x/¯ y }. Furthermore id{¯x} stands we call δ = {¯ y /¯ x} a renaming and use δ −1 for {¯ for {¯ x/¯ x}. We use the following notations for operations on FSubst: θ ↓ d := {t/x | (t/x) ∈ θ and x ∈ d} (d ⊂ var) θ − x := θ ↓ (Dom(θ) \ {x}) for variables x θ · σ := {tσ/x | (t/x) ∈ θ} The operation · can be deﬁned as (θ◦σ) ↓ Dom(θ) where ◦ stands for the usual composition, and vice versa θ ◦ σ = (θ · σ) ∪ (σ ↓ (Dom(σ) \ Dom(θ))) (if bindings x/x are not removed from θ ◦ σ). For θ, σ ∈ FSubst, θ ≈ σ iﬀ θ · δ = σ for a renaming δ ∈ FSubstRg(θ) . If Dom(θ) ∩ Dom(σ) = ∅ and also Rg(θ) ∩ Rg(σ) = ∅,

Modeling Meta-logical Features in a Calculus with Frozen Variables

121

we call θ and σ disjoint and use the notation θ∪· σ for θ ∪ σ. Let D(θ) := {d ⊂ Dom(θ) | (θ ↓ d)∪· δ = θ for some renaming δ} for all θ ∈ FSubst and σ ∼ θ iﬀ σ ↓ D(σ) ≈ θ ↓ D(θ). The set of answers is AS := FSubst/ ∼, θ˜ = {σ ∈ FSubst | σ ∼ θ} (θ ∈ FSubst), and ASd := {θ˜ | θ ∈ FSubstd } (d ⊂ var ﬁnite). · σ for some σ ∈ α For every θ ∈ FSubst, α ∈ ASRg(θ) , d ⊂ var, let θ · α := θ that satisﬁes Dom(σ) = Rg(θ), and α ↓ d := σ ↓ d for some σ ∈ α. In prolog the user can decide for backtracking as long as there has been no termination symbol, hence the evaluation of a goal may produce several, also inﬁnitely many answers. As results we get ﬁnite terminating, ﬁnite nonterminating and inﬁnite sequences. Gathering these three kinds of sequences in a set and adding the appropriate approximation ordering, we arrive at a domain of streams. This structure has been used before for the semantics of logic programs (see [8], [3], [1]). Let us recall some basic facts about streams and specialize to the case of streams of substitutions. Let M be a set. The set of streams over M is Stream(M ) := Mn ∪ (M n × {⊥}) ∪ M ω n∈ω

n∈ω

where ⊥ ∈ M . We use [m1 , . . . , mn ] for elements in M n , [m1 , . . . , mn , ⊥] for those in M n × {⊥}, (mi )i∈ω for elements in M ω . S iscalled total ifS ∈ n∈ω M n ∪ M ω , partial otherwise. S is called ﬁnite if S ∈ n∈ω M n ∪ ( n∈ω M n × {⊥}). Preﬁxing is denoted by ::, i.e. m0 :: [m1 , . . . , mn , ⊥] = [m0 , m1 , . . . , mn , ⊥], and m0 :: [m1 , . . . , mn ] = [m0 , m1 , . . . , mn ], and m0 :: (mi+1 )i∈ω = (mi )i∈ω . The symbol ∗ stands for stream concatenation, i.e. S ∗ S = S if S is partial or inﬁnite, [m1 , . . . , mn ] ∗ S = m1 :: . . . :: mn :: S, and denotes the usual ordering on streams, i.e. S1 S2 iﬀ S1 = S2 or S1 = [m1 , . . . , mn , ⊥] and S2 = [m1 , . . . , mn ] ∗ S for some m1 , . . . , mn ∈ M and a stream S . The least element is denoted by ⊥. If f : M −→ M , we use map(f ) for the corresponding function on Stream(M ) whose application amounts to applying f to every element: map(f )([ ])=[ ] map(f )(⊥)=⊥

map(f )(m :: S) =f (m) :: (map(f )(S)) map(f )((mi )i∈ω )=(f (mi ))i∈ω .

It is convenient to associate with every stream S a type |S|: |[m0 , . . . , mn ]| := {0, . . . , n}, |[m0 , . . . , mn , ⊥]| := {0, . . . , n, ⊥}, |(mi )i∈ω | := ω. We use S(i) for the (i + 1)th component of S if i ∈ |S| ∩ N, and extend this by S(⊥) := ⊥. Given a stream S and a function F : |S| ∩ N −→ Stream(M ), let  F (0) ∗ . . . ∗ F (n) if |S| = {0, . . . , n}  F (0) ∗ . . . ∗ F (n) ∗ ⊥ if |S| = {0, . . . , n, ⊥} ∗ F (i) :=  i∈|S| supn∈ω (F (0) ∗ . . . ∗ F (n) ∗ ⊥) if |S| = ω. For every S ∈ Stream(M ) and F : M −→ Stream(M ) we use ∗m∈S F (m) for ∗i∈|S| F (S(i)). Note that (Stream(M ), ) is an algebraic cpo with least element

122

B. Elbl

⊥. Furthermore, every (Si )i∈I that is bounded above is a chain, and every ﬁnite element is compact. The operation ∗ is continuous. For d ⊂ varwe deﬁne AStreamd := Stream(ASd ). The set of answer streams is AStream := d⊂Var ﬁnite AStreamd . For S ∈ Stream(FSubstd ) we use S˜ for ˜ ∗θ∈S [θ]. The symbols · and ↓ are also used for the “mapped” operations where one argument is a stream of ﬁnite substitutions or an answer stream. The value of a goal includes the results of evaluation of all instances. Hence a function FSubst −→ AStream is assigned to every goal as its semantic value. Let F : FSubst −→ Stream(AS), d ⊂ var. Then F ↓ d is the function deﬁned by (F ↓ d)(θ) := F (θ ↓ d) and D(F ) := {d ⊂ Var | F = F ↓ d}. Assume informally a semantics for prolog goals that assigns to every G the function [[G]] that maps every ﬁnite substitution θ, Dom(θ) ⊃ fv(G) to the stream of answers produced when evaluating ?− Gθ. If Dom(θ) ⊃ fv(G) then θ∪· δ for an appropriate renaming δ is considered instead and the result is restricted to the variables in Rg(θ). Then it is easy to see that the following conditions are satisﬁed: 1. D(F ) is ﬁnite. 2. F (θ) ∈ AStreamRg(θ) for all θ ∈ FSubst 3. F (θ · δ) = δ −1 · F (θ) for all renamings δ ∈ FSubstRg(θ) for all θ ∈ FSubst 4. F (θ∪· δ) ↓ Rg(θ) = F (θ) for all θ ∈ FSubst and renaming δ so that δ,θ are disjoint. In [4] these conditions have been presented as an alternative characterization of SF which is used there as the domain of values of goals. Here (as in [6]) we use them for the deﬁnition of G: Deﬁnition 7. The set G is the set of functions F : FSubst −→ Stream(AS) that satisfy the conditions 1–4. Furthermore G(d) := {F ∈ G | D(F ) ⊂ d}. If A[θ] is any expression so that λθ ∈ FSubstd .A[θ] is a function FSubstd −→ Stream(AS) so that f (θ) ∈ AStreamRg(θ) and f (θ · δ) = δ −1 · f (θ) for every θ ∈ FSubstd and renamings δ ∈ FSubstRg(θ) , then there is a uniquely determined extension F of f in G(d) which is denoted by λθ : d.A[θ]. ˜ if (t¯) and (¯ For term tuples t¯, s¯ of equal length let mgu(t¯; s¯) := [θ] s) are uniﬁable with computed mgu θ = {¯ r/¯ x}, fv(t¯, s¯) = {¯ x}, and mgu(t¯; s¯) = [ ] if (t¯) and (¯ s) are not uniﬁable. The function mt¯;¯s is deﬁned by mt¯;¯s := λθ : var(t¯, s¯).mgu(t¯θ; s¯θ). Deﬁnition 8. Let F, G ∈ G. The functions F −x, F ∗G, Fθ , F ⊗G : FSubst −→ Stream(AS) are deﬁned by 1. 2. 3. 4.

F − x := F ↓ (D(F ) \ {x}) for all variables x (F ∗ G)(θ) = F (θ) ∗ G(θ) for all θ ∈ FSubst Fθ := λσ : Rg(θ).F (θ · σ) for θ ∈ FSubst F ⊗G := λθ : D(F )∪D(G).(F ×G)(θ) where (F ×G)(θ) := ∗σ∈Sθ (σ ·G(θ·σ)) for streams Sθ in Stream(FSubstRg(θ) ) satisfying S˜θ = F (θ).

Modeling Meta-logical Features in a Calculus with Frozen Variables

123

The functions F − x, Fθ , F ∗ G, F ⊗ G are in G if F, G are. We assume the usual ordering on functions for G. Then (G, ) is obviously a partially ordered set with least element λθ : ∅.⊥. Furthermore we will make use of the following properties of stream functions: 1. Functions F, G in G are equal if they coincide on some FSubstd where D(F )∪ D(G) ⊂ d ⊂ var, d ﬁnite. 2. If F, G ∈ G and Dom(θ) ⊃ D(F ) ∪ D(G), then (F ⊗ G)(θ) = (F × G)(θ) for × in the deﬁnition above. 3. (G, ⊗, 1l) and (G, ∗, F) are monoids where 1l := λθ : ∅.[˜∅], and F := λθ : ∅.[ ]. 4. For every ﬁnite d ⊂ var, (G(d), ) is a cpo and ⊗, ∗, ·θ , ↓ d, −x are continuous on G(d). The domains for the terms and predicates are deﬁned next. Deﬁnition 9. The set T is the set of terms (of type ι) and Pn is the set of functions f : Tn −→ AStream satisfying: – f (t¯) ∈ AStream(var(t¯)) for every (t¯) ∈ Tn – f (t¯δ) = δ −1 · f (t¯) for every renaming δ ∈ FSubstvar(t¯) Furthermore Tn G is the set of functions f ∈ Tn −→ G so that f (t¯)(θ) = f (¯ s)(σ) if t¯θ = s¯σ for every (t¯), (¯ s) ∈ Tn and θ, σ ∈ FSubst satisfying Dom(θ) ⊃ ¯ var(t), Dom(σ) ⊃ var(¯ s). The function p2tgn : Pn −→ (Tn G) is deﬁned by p2tgn (f )(t¯) := λθ : var(t¯).f (t¯θ) for θ ∈ FSubstvar(t¯) . Ordered with the usual ordering on functions Pn and Tn G are domains. The function p2tgn is a monotonic, continuous bijection. The elements of P are used as interpretations of predicates. The interpretation of application must ensure that applying the value of a predicate to terms yields an element of G. Hence we will combine p2tgn with ordinary application. The restriction to P as domain for predicates implies that the models considered below yield a standard structure in the sense of [4], Sec. 5.2. 3.2

Semantics for Kfrz

First we deﬁne a general notion of model for Kfrz [T ]. Deﬁnition 10. A P-G-interpretation I of Σ is an assignment of elements [[b]] ∈ Pn to the built-in predicates b: ιn −→ o and of mappings [[◦]]: Gn −→ G to the connectives ◦: on −→ o so that ˜ [[F]] = λθ : ∅.[ ], [[0]] = λθ : ∅.⊥, and 1. [[=]] = λt, s.mgu(t; s), [[1]] = λθ : ∅.[∅], the connectives ⊗ and ∗ are interpreted by the corresponding operations on G, 2. every [[◦]] is monotonic and continuous on all G(d), d ⊂ var ﬁnite, and

124

B. Elbl

3. for every connective ◦: on −→ o, G1 , . . . , Gn ∈ G and ﬁnite substitution θ so that Dom(θ) ⊃ D(G1 ) ∪ . . . ∪ D(Gn ) the equation ([[◦]](G1 , . . . , Gn ))θ = [[◦]]((G1 )θ , . . . , (Gn )θ ) holds. A P-G-structure M is a pair (Ipr , IΣ ) where IΣ is a P-G-interpretation of Σ and Ipr assigns elements [[p]] of Pn to all predicate names p in predn . The mapping idV is given by idV (x) = x for every variable x. The value of a goal in a P-G-structure M = (Ipr , IΣ ) w.r.t. a variable assignment ϕ: var −→ T is deﬁned recursively by: [[p(t¯)]]M,ϕ = p2tgn ([[p]]))(t¯{ϕ(x)/x | x in t¯}) if p ∈ predn or b: ιn −→ ι [[◦(G1 , . . . , Gn )]]M,ϕ = [[◦]]([[G1 ]]M,ϕ , . . . , [[Gn ]]M,ϕ ) if ◦: on −→ o [[ExG]]M,ϕ = [[G]]M,ϕx←v − v for some variable v not in any ϕ(y), y ∈ fv(G), and [[G]]M := [[G]]M,idV . A sequent Γ ⇒d ∆ is valid in M iﬀ [[⊗ Γ ]]M (θ) [[∗ ∆]]M (θ) for every ﬁnite substitution θ satisfying D(θ) ∩ d = ∅. d ¯ For a program P , a P-G-structure is a model iﬀ every sequent DefP p (t) ⇒ p(t¯) which is obtained by substitution (and bound renaming if necessary) from an element in P is valid in M. We can read the deﬁnition above as follows: The carrier of a P-G-structure is T. Every symbol c: ιn −→ ι is interpreted as λt¯.c(t¯). The interpretation of the quantiﬁer is determined by · − x. While the interpretation of the ﬁxed symbols is given by the operations deﬁned in subsection 3.1, the remaining symbols in Σ are interpreted by some IΣ . Validity in M refers only to the assignment idV but it is equivalent to a notion of validity w.r.t. all assignments as stated below. Lemma 11. Let M be a P-model. For every assignment ϕ, let ϕe denote the ﬁnite substitution {ϕ(x)/x | x ∈ e} for ﬁnite e ⊂ var, and, for every ﬁnite d ⊂ var, M |= Γ ⇒d ∆[ϕ] iﬀ [[⊗ Γ ]]M,ϕ (θ) [[∗ ∆]]M,ϕ (θ) for all θ ∈ FSubst satisfying Dom(θ) = Rg(ϕfv(Γ,∆) ) and D(ϕfv(Γ,∆) · θ) ∩ d = ∅. Then 1. [[G]]M,ϕ = ([[G]]M )ϕfv(G) for all goals G and 2. M |= Γ ⇒d ∆ iﬀ M |= Γ ⇒d ∆[ϕ] for all ϕ. Proof. The second statement follows using the ﬁrst, which in turn is proved by induction on G, using the deﬁnition of p2tg and the conditions on the interpretations of connectives. Deﬁnition 12. For Σstruct we ﬁx the following standard interpretation: [˜ ∅] if t is a variable [[var]](t) = [ ] otherwise [˜ ∅] if t is ground [[ground]](t) = [ ] otherwise u/¯ x}, s) ↓ var(s) where var(t) = {¯ x}, {¯ u/¯ x} is a renam[[copy]](t, s) = mgu(t{¯ ing, {¯ u} ∩ var(s) = ∅.

Modeling Meta-logical Features in a Calculus with Frozen Variables

125

Deﬁnition 13. For Σcond we ﬁx the following standard interpretation: [[(· → ·; ·)]](G, H1 , H2 ) = λθ : D(G) ∪ D(H1 ) ∪ D(H2 ).FG,H1 ,H2 (θ) σ , ⊥], Dom(σ) = Rg(θ)  σ · H1 (θ · σ) if G(θ) [˜ H2 (θ) if G(θ) = [ ] where FG,H1 ,H2 (θ) =  ⊥ otherwise Furthermore [[fail if]](G) = [[(· → ·; ·)]](G, λθ : ∅.[ ], λθ : ∅.[˜∅]), [[once]](G) = [[(· → ·; ·)]](G, λθ : ∅.[˜ ∅], λθ : ∅.[ ]), and [[succeed if]](G) = [[fail if]]([[fail if]](G)).

4

Properties of Kfrz

For this subsection we ﬁx Σ = Σstruct ∪ Σcond and the standard interpretation as just deﬁned. Hence |= refers to this interpretation and · · to derivability in Kfrz [Tstruct ∪ Tcond ]. 4.1

Soundness of Kfrz

Theorem 14. Let P be a program and Γ ⇒d ∆ a sequent. If P Γ ⇒d ∆ then Γ ⇒d ∆ holds in every model of P . Proof. By induction on the height of the derivation, distinguishing cases according to the last rule. We use the notation F d G for F (θ) G(θ) for all θ ∈ FSubst so that D(θ) ∩ d = ∅. We consider only the cases where frozen variables are relevant: (Γ ⇒d G1 ), (Π ⇒e G2 ) (Γ, Π ⇒d∪e G1 ⊗ G2 ), fv(Γ ) ∩ e = ∅: Let F1 := [[⊗ Γ ]]M and F2 := [[⊗ Π]]M . Then by IH F1 d [[G1 ]]M and F2 e [[G2 ]]M , and D(F1 ) ∩ e = ∅. Let θ ∈ FSubst so that D(θ) ∩ (d ∪ e) = ∅ and Dom(θ) = D(F1 ) ∪ D(F2 ) ∪ D([[G1 ]]M ) ∪ D([[G2 ]]M ), and S ∈ Stream(FSubstRg(θ) ) so that S˜ = F1 (θ). Then D(θ · σ) ∩ e = ∅ for every σ in S, as D(θ) ∩ e = ∅ and D(F1 ) ∩ e = ∅. As a consequence, (F1 ⊗ F2 )(θ) = ∗ σ · F2 (θ · σ) ∗ σ · [[G2 ]]M (θ · σ) ([[G1 ]]M ⊗ [[G2 ]]M )(θ).

σ∈S

σ∈S

(G ⇒d H) (ExG ⇒d ExH): By IH [[G]]M d [[H]]M . Let θ ∈ FSubst so that D(θ) ∩ (d \ {x}) = ∅. Then ([[G]]M − x)(θ) = [[G]]M (θ − x) [[H]]M (θ − x) = ([[H]]M − x)(θ). Similar reasoning applies to the remaining cases of quantiﬁer rules. G ⇒d H x = t, G ⇒d∪{x} x = t ⊗ H and x ∈ d: The case that x occurs in t is immediate. Hence assume that x does not occur in t. Let F1 := [[G]]M and F2 := [[H]]M . By IH F1 d F2 . Let θ ∈ FSubst so that D(θ) ∩ (d ∪ {x}) = ∅, Dom(θ) = D(F1 ) ∪ D(F2 ) ∪ {x} ∪ fv(t). As x ∈ Dom(θ) \ D(θ) there are θ0 ∈ FSubst and a variable u so that θ = θ0 ∪· {u/x}. For the variables v¯ in Rg(θ0 ) we have (mx;t ⊗ F1 )(θ) = ({tθ0 /u} ∪ {¯ v /¯ v }) · F1 (θ · ({tθ0 /u} ∪ {¯ v /¯ v })) = ({tθ0 /u}∪{¯ v /¯ v })·F1 (θ0 ∪{tθ0 /x}).As x ∈ d, the set D(θ0 ∪{tθ0 /x})∩d is empty. Hence (mx;t ⊗ F1 )(θ) ({tθ0 /u} ∪ {¯ v /¯ v }) · F2 (θ0 ∪ {tθ0 /x}) = (mx;t ⊗ F2 )(θ).

126

B. Elbl

The soundness of the rules for Σcond is immediate from the deﬁnition of the interpretation and the soundness of the monotonicity rule (G ⇒d G ), (H1 ⇒e1 H1 ), (H2 ⇒e2 H2 ) (G → H1 ; H2 ) ⇒d∪e1 ∪e2 (G → H1 ; H2 ) if fv(G) ∩ e1 = ∅ which is proved similar to the ﬁrst case. 4.2

Relating Kfrz to an Operational Semantics

It will be shown that Kfrz is adequate in the following sense: if S is a computed value for a goal G evaluated w.r.t. a program P then the corresponding sequent is derivable in the calculus. Although values as just deﬁned may be inﬁnite, the computed values here are only ﬁnite approximations to this obtained in ﬁnite time. The latter are represented by expressions in our language. Deﬁnition 15. Let m ≥ 0. The goals A1 ∗ . . . ∗ Am and A1 ∗ . . . ∗ Am ∗ 0 are called solved if each Ai is a positive answer. The property we show below is the following: if a solved goal approximates a goal G operationally then S ⇒d G can be proved for d = fv(S, G). This can be viewed as soundness of the operational semantics w.r.t. the calculus but does not imply the completeness of the calculus w.r.t. the standard interpretation above. As we are not concerned with the connection to search for SLD refutations here, we assume a diﬀerent operational semantics, based on rewriting goals. Deﬁnition 16. Let P be a program. The relation → is deﬁned by: ¯ p(t¯) → DefP p (t) (G1 ⊗ G2 ) ⊗ H → G1 ⊗ (G2 ⊗ H) (G1 ∗ G2 ) ⊗ H → (G1 ⊗ H ∗ G2 ⊗ H) ∗(Π, E¯ u. ⊗ (¯ x = t¯, Ev.G, Γ ), ∆)) → ∗(Π, E¯ uEv. ⊗(¯ x = t¯, G, Γ ), ∆) if v not free in x ¯, t¯, Γ ∗(Π, E¯ u. ⊗ (¯ x = t¯, 1, Γ ), ∆) → ∗(Π, E¯ u. ⊗ (¯ x = t¯, Γ ), ∆) ∗(Π, E¯ u. ⊗ (¯ x = t¯, F, Γ ), ∆) → ∗(Π, ∆) ∗(Π, E¯ u. ⊗ (¯ x = t¯, s1 = s2 , Γ ), ∆) → ∗(Π, E¯ u. ⊗ (¯ x = t¯, y¯ = r¯, Γ ), ∆) y ; r¯) and (s1 ; s2 ) have the same uniﬁers, if s1 is no variable, (¯ fv(s1 , s2 ) ⊂ fv(¯ y , r¯), and no yi occurs in some rj . ∗(Π, E¯ u. ⊗ (¯ x = t¯, s1 = s2 , Γ ), ∆) → ∗(Π, E¯ u. ⊗ (¯ x = t¯, F, Γ ), ∆) if s1 and s2 are not uniﬁable ∗(Π, E¯ u. ⊗ (¯ x = t¯, y = s, Γ ), ∆) → ∗(Π, E¯ u. ⊗ ((¯ x, y) = (t¯{s/y}, s), Γ {s/y}), ∆) if y not in s, u ¯, x ¯. ∗(Π, E¯ u. ⊗ (¯ x = t¯, ui = s, Γ ), ∆) → ∗(Π, E¯ v . ⊗ (¯ x = t¯{s/ui }, Γ {s/ui }), ∆) ¯ where v¯ is obtained from u ¯ by deleting ui . if ui not in s, x 1 if t is a variable var(t) → F otherwise 1 if t is ground ground(t) → F otherwise copy(t, s) → E¯ u(s = t{¯ u/¯ x}) where fv(t) = {¯ x} and {¯ u/¯ x} is a renaming so that {¯ u} ∩ fv(s) = ∅.

Modeling Meta-logical Features in a Calculus with Frozen Variables

127

fail if(F) → 1 fail if(A ∗ G) → F if A is a positive answer succeed if(F) → F succeed if(A ∗ G) → 1 if A is a positive answer once(F) → F once(A ∗ G) → A if A is a positive answer (F → H1 ; H2 ) → H2 (A ∗ G → H1 ; H2 ) → A ⊗ H1 if A is a positive answer If necessary we add P as subscript to emphasize the dependency. To avoid circular reductions, e.g. (x1 = c1 ⊗x2 = c2 )⊗x3 = c3 →+ (x1 = c1 ⊗x2 = c2 )⊗x3 = c3 one may wish to restrict → further. For the results below, however, this is not necessary. Lemma 17. If G → H then fv(H) ⊂ fv(G) and P H ⇒d G for all ﬁnite var ⊃ d ⊃ fv(G). Proof. Straightforward assignment of Kfrz derivations to reductions G → H. The relation → determines reductions. But if this operational semantics shall capture the intended informal meaning they must not be performed in arbitrary contexts. To model the eﬀect of the point of selection correctly the admissible contexts must be restricted. As usual a context C is an expression with a hole . The expression C[G] denotes the result of substituting G for the hole where variables in G may be bound. Deﬁnition 18. The set of D-contexts (“disjunctive”) is inductively deﬁned by: – The empty context is a D-context. – ∗(Π, E¯ u. ⊗ (¯ x = t¯, C, Γ ), ∆) is a D-context if • Π consists of positive answers and ∆ of goals, • u ¯ are pairwise distinct variables, • x ¯ are pairwise distinct variables which do not occur free in Γ, t¯, u ¯, C, and • C is a D-context. – fail if(C), succeed if(C), once(C), and (C → H1 ; H2 ) are D-contexts if C is a D-context and H1 , H2 are goals. The sets of relevant bound variables rbv(C) and relevant free variables rfv(C) of a D-context C are recursively deﬁned by: rbv( ) = rfv( ) = ∅ rbv(fail if(C)) = rbv(succeed if(C)) = rbv(once(C)) = rbv((C → H1 ; H2 )) = rbv(C) rfv(fail if(C)) = rfv(succeed if(C)) = rfv(once(C)) = rfv((C → H1 ; H2 )) = rfv(C) rbv(∗(Π, E¯ u. ⊗ (¯ x = t¯, C, Γ ), ∆)) = rbv(C) ∪ {¯ u} rfv(∗(Π, E¯ u. ⊗ (¯ x = t¯, C, Γ ), ∆)) = (rfv(C) \ {¯ u}) ∪ {¯ x}. Here ∗(G1 , . . . , Gn ) and ⊗(G1 , . . . , Gn ) stand for the disjunction or conjunction respectively of the formulas G1 , . . . , Gn .

128

B. Elbl

Deﬁnition 19. The relation on goals is deﬁned by C[G] C[H] if G → H and C is a D-context so that rfv(C) ∩ fv(G, H) = ∅. Lemma 20. Let P be a program, G, H goals, d ⊂ var ﬁnite, and C a D-context so that rfv(C) ∩ d = ∅. If P G ⇒d H then P C[G] ⇒(d\rbv(C))∪rfv(C) C[H]. Proof. By induction on C. The case of an empty context is immediate, and for fail if(C), succeed if(C), once(C), and (C → H1 ; H2 ) we just combine the induction hypothesis with the monotonicity of the connective. So consider u. ⊗(¯ x = t¯, C, Γ ), ∆): By IH P C[G] ⇒(d\rbv(C))∪rfv(C) C[H]. C ≡ ∗(Π, E¯ x = t¯, C[G], Γ ) As xi are neither free in C nor in d, we can deduce P ⊗(¯ (d\rbv(C))∪rfv(C)∪{¯ x} ¯ ¯ ⇒ ⊗(¯ x = t, C[H], Γ ), hence P E¯ u. ⊗(¯ x = t, C[G], Γ ) ⇒d x})\{¯ u} = (d\(rbv(C)∪ E¯ u. ⊗(¯ x = t¯, C[H], Γ ), where d = ((d\rbv(C))∪rfv(C)∪{¯ {¯ u})) ∪ (rfv(C) \ {¯ u}) ∪ {¯ x}. This implies P C [G] ⇒(d\rbv(C ))∪rfv(C ) C [H]. Theorem 21. Let P be a program, G a goal, fv(G) = {¯ x}, {¯ u/¯ x} a renaming so that {¯ u} ∩ {¯ x} = ∅, and S a solved goal. If E¯ u(¯ x = u ¯ ⊗ G{¯ u/¯ x}) ∗ S {¯ x} ∗ G. If E¯ u(¯ x = u ¯ ⊗ G{¯ u/¯ x}) S ∗ H for some H then then P S ⇒ P S ∗ 0 ⇒{¯x} G. Proof. By induction on the length of the computation we show that E¯ u(¯ x = u ¯ ⊗ G{¯ u/¯ x}) ∗ H implies P H ⇒{¯x} E¯ u(¯ x = u ¯ ⊗ G{¯ u/¯ x}). Assume that E¯ u(¯ x=u ¯ ⊗ G{¯ u/¯ x}) n H1 H2 . Then fv(H2 ) ⊂ fv(H1 ) ⊂ {¯ x} and there is a D-context C so that Hi = C[Hi ], i = 1, 2, for some H1 , H2 satisfying H1 → H2 and rfv(C) ∩ fv(H1 , H2 ) = ∅. Combining Lem.17 and Lem.20 we obtain that P C(H2 ) ⇒d C(H1 ) for d = (fv(H1 , H2 ) \ rbv(C)) ∪ rfv(C), hence P H2 ⇒{¯x} H1 , as (fv(H1 , H2 ) \ rbv(C)) ∪ rfv(C) ⊂ {¯ x}. Combining this with the induction hypothesis yields P H2 ⇒{¯x} E¯ u(¯ x=u ¯ ⊗ G){¯ u/¯ x}. Observing that S ∗ 0 ⇒∅ ∅ S ∗ H for every H and E¯ u(¯ x=u ¯ ⊗ G{¯ u/¯ x}) ⇒ G completes the proof.

5

Conclusion

The problem of modeling meta-logical features in a proof-theoretic setting has been addressed. The calculus Kfrz provides a logical semantics of the programming constructs deﬁned by the operational semantics in Sec.4.2. In this respect the approach presented here contrasts to a description of prolog as in [2], which, on the other hand, applies to the full language prolog. The crucial ingredient here is ‘freezing’ variables. Frozen variables diﬀer from free ones because we do not have the substitution property for them. They are no constants which is indicated by the fact that distinct frozen variables do unify. Furthermore they may occur in quantiﬁcation rules where variables are expected. Freezing variables is a binding mechanism on the sequent level in the sense that it turns variables into non-free objects but in contrast to bound variables assignments to frozen variables are not completely irrelevant, and moreover they

Modeling Meta-logical Features in a Calculus with Frozen Variables

129

are still aﬀected by a regular binding by quantiﬁcation performed later in the deduction. Hence frozen variables do not belong to any of these groups. The problem of restricting a judgment to the ‘uninstantiated’ case occurred before in considering lazy list comprehension in [5] where it was solved by introducing auxiliary predicates ∇n which corresponds to checking whether the arguments are distinct free variables but looping (not failing) if they are not. Instead of S ⇒{¯x} G (¯ x the distinct free variables in G) one then derives ∇(¯ x), S ⇒ G. Although one is interested in the sequents ∇(¯ x), S ⇒ G only, the ∇ expressions may occur anywhere in the sequent, and special axioms and rules for ∇ have to be added. Compared to this approach the work presented here can be viewed as further analysis of the utilization of ∇, restricting it to the originally intended result judgments and avoiding extra axioms and rules by absorbing them into the remaining rules. By modeling the eﬀect of the Σcond group we obtain an example how a proof-theoretic approach can cope with features with a quite non-logical ﬂavor. The general setting of Kfrz , however, could well be applied to other connectives, e.g. related to a more advanced selection mechanism, and may even be used as a guide in their design.

References 1. M. Baudinet. Proving termination properties of Prolog programs: A semantic approach. Journal of Logic Programming, 14(1 and 2):1–29, October 1992. 2. E. B¨ orger and D. Rosenzweig. A mathematical deﬁnition of full Prolog. Science of Computer Programming, 24(3):249. 3. S. K. Debray and P. Mishra. Denotational and operational semantics for Prolog. Journal of Logic Programming, 5(1):61–91, March 1988. 4. B. Elbl. A declarative semantics for depth-ﬁrst logic programs. Journal of Logic Programming, 41(1):27–66, 1999. 5. B. Elbl. Lazy list comprehension in logic programming. Journal of Logic and Computation, (to appear). 6. B. Elbl. A non-deﬁnability result for a predicational language with the usual control. International Journal of Foundations of Computer Science, 12(3):385– 396, 2001. 7. J.-Y. Girard. Linear logic. Theoretical Computer Science, 50, 1987. 8. N. D. Jones and A. Mycroft. Stepwise development of operational and denotational semantics for Prolog. In Proceedings of the 1984 International Symposium on Logic Programming, pages 281 – 288. IEEE, 1984. 9. G. E. Mints. Complete calculus for pure prolog. Proc. Acad. Sci. Estonian SSR, 35(4):367–380, 1986. 10. P. Schroeder-Heister. Deﬁnitional reﬂection and the completion. In R. Dyckhoﬀ, editor, Extensions of Logic Programming. Fourth International Workshop, St. Andrews, Scotland, April 1993, Proceedings, Springer Lecture Notes in Artiﬁcial Intelligence, pages 333–347, 1994. 11. J. Shepherdson. Mints type deductive calculi for logic programming. Annals of Pure and Applied Logic, 56:7–17, 1992. 12. L. Sterling and E. Y. Shapiro. The Art of Prolog. MIT Press, 1986.

Proof Theory and Post-turing Analysis Lew Gordeew T¨ ubingen University WSI f¨ ur Informatik, Logik und Sprachtheorie Sand 13, D-72076 T¨ ubingen, Germany [email protected]

Abstract. Traditional proof theory and Post-Turing computability are parts of discrete mathematics, whereas traditional analysis deals with non-discrete objects like real numbers and related topological notions. On the other hand, familiar mathematical proofs very often use methods of (functional) analysis which are compatible with functional formalizations of Post-Turing computability. We elaborate these connections with regard to the polynomial-time computability.

1

Introduction

Traditional proof theory provides a powerful tool for proving conservation results. That is to say, if we are given three classes N , M, K such that N ⊆ M, and if we conjecture that N ∩ K ⊆ M ∩ K in fact strengthens to N ∩ K = M ∩ K then we can hope to prove this conjecture by the appropriate cut elimination techniques. In particular, having P ⊆ NP (i.e. P ≤ NP) one can try to prove the conjecture P = NP (?) by using proof theoretical methods. In fact, the study was made in this direction (cf. [T]) by transferring P = NP (?) to the analogous proof theoretical conjecture S12 = S22 (?), where each Si2 (i ≥ 0) denotes a sequent calculus in the 1-order language Lb with: – three binary predicates =, <, ≤ – two individual constants 0, 1 – ﬁve functions +, ·, λx. |x|, λx. 12 x , λxy.xy, where: • |x| = the length of the binary expansion of x with |x| = 0 • 12 x = max {y ∈ N | 2y ≤ x} • xy = 2|x||y| that extends basic Gentzen sequent calculus LK by adding: – deﬁning axioms for the underlying predicates, individual constants and functions – deﬁning rules for bounded quantiﬁers (∀x ≤ a), (∃x ≤ a) – the following weak induction rule Σib −PIND R. Kahle, P. Schroeder-Heister, and R. St¨ ark (Eds.): PTCS 2001, LNCS 2183, pp. 130–152, 2001. c Springer-Verlag Berlin Heidelberg 2001

Proof Theory and Post-turing Analysis

Σib −PIND :

A

1 2 a , Γ → ∆, A (a)

A (0) , Γ → ∆, A (t)

131

if A (a) ∈ Σib , a ∈ / FV (Γ, ∆, A (t))

where Σib are classes of Lb -formulas which are deﬁned along with the dual classes Πib by the recursion on i ≥ 0, as follows. 1. Σ0b = Π0b = the formulas whose quantiﬁers are all in the sharply bounded form (∀x ≤ |a|) or (∃x ≤ |a|). b b and Πk+1 are the smallest classes of formulas satisfying the following 2. Σk+1 eight conditions: b a) Πkb ⊆ Σk+1 b b b b) if A ∈ Σk+1 then (∀x ≤ |a|) A ∈ Σk+1 and (∃x ≤ a) A ∈ Σk+1 b b b b c) if A ∈ Σk+1 and B ∈ Σk+1 then A ∧ B ∈ Σk+1 and A ∨ B ∈ Σk+1 b b b b d) if A ∈ Σk+1 and B ∈ Πk+1 then ¬B ∈ Σk+1 and B → A ∈ Σk+1 b e) Σkb ⊆ Πk+1 b b b f) if A ∈ Πk+1 then (∀x ≤ |a|) A ∈ Πk+1 and (∃x ≤ a) A ∈ Πk+1 b b b b g) if A ∈ Πk+1 and B ∈ Πk+1 then A ∧ B ∈ Πk+1 and A ∨ B ∈ Πk+1 b b b b h) if A ∈ Πk+1 and B ∈ Σk+1 then ¬B ∈ Πk+1 and B → A ∈ Πk+1 By familiar considerations (cf. [B,T]), one can infer P = NP from S12 = S22 . Having this, one could hope to prove S12 = S22 by some “weak” cut elimination techniques showing that S22 is in fact a conservative extension of S12 . To this end, one should be able to eliminate or at least weaken the instances Σ2b −PIND occurring in a given derivation in S22 . The question about such “weak” cut elimination is still open. However, it is known that on the one hand full cut elimination implies full exponentiation, provably in S12 , and on the other hand ∀x∃y (y = 2x ) is not provable in S12 (see references and discussion in [T]). This shows that familiar proof theoretical methods might be not ﬁne enough, when dealing with questions like S12 = S22 (?). On the other hand, it is doubtful that a hierarchy like Σib i≥0 that is based on bounded quantiﬁers is ﬁne enough for the desired proof theoretical translation of the notions of computational complexity. We ask if there are other, more natural formalizations of Post-Turing computability, which can provide us with functional hierarchies using other parameters? Now consider the dual conjecture P = NP (?), i.e. P < NP (?). While transferring P = NP (?) to S12 = S22 (?), one can hope to infer S12 = S22 from the appropriate “weak” incompleteness theorems by encoding metamathematics in some Si2 (see references and discussion in [T]). However, the bounded quantiﬁer approach might be too rough for this sake, too. Analogous encoding problems arise, when trying to infer P = NP from the relative consistency of Pf = NPf (cf. [T]). On the other hand, if P < NP holds then we can try to prove it in a straightforward way. To this end, it would suﬃce to prove that a chosen NPcomplete problem is not decidable by any polynomial time Turing machine. For example, one can take either the consistency (= satisﬁability) problem SATcnf with respect to boolean conjunctive normal formulas (abbr.: CNF) or, by duality,

132

L. Gordeew

negated tautology problem TAUdnf with respect to boolean disjunctive normal formulas (abbr.: DNF). So the question arises how to prove SATcnf ∈ / PTIME / PTIME should it really be the case? Furthermore, by duality, it a/o TAUdnf ∈ will suﬃce to prove that TAUdnf ∈ / PTIME holds. Consider DNF =

i∈I

j∈J(i)

Lij

where Lij are literals, # (I) , # (J (i)) < ∞ for all i ∈ I, j ∈ J (i). We ask how to prove the conjecture that ∈ TAUdnf cannot be veriﬁed in polynomial time? Now is a tautology iﬀ for every choice function f : I i → f (i) ∈ J (i), i the correlated diagonal choice sequence Df = Lf (i) | i ∈ I is inconsistent,

i.e. (∃i, k ∈ I) Lif (i) = ¬Lkf (k) . So a hypothetical “naive” PTIME-solution for ∈ TAUdnf should be able to: 1. PTIME-enumerate a suitable “suﬃcient” set f0 , f1 , ..., fι , ... of the above choice functions, 2. PTIME-verify if every subsequent diagonal choice sequence Dfι is inconsistent. Part 2 is unproblematic, but part 1 must fail, since for suﬃciently long tautologies , every “suﬃcient” set of choice functions is exponential in # (). The latter follows from the familiar result that for suﬃciently long inconsistent , the number of clauses in every resolution proof of ¬ is exponential in # () (see [H]). Arguing ad absurdum, this can serve as a proof of the corresponding weak variant of the conjecture TAUdnf ∈ / PTIME. Of course, the general case is more involved, since, in the above description, part 1 might include other components of than the (literals determined by the) choice functions, while part 2 might be based on other veriﬁcation ideas. Furthermore, both parts can be interactive. Loosely speaking, our hypothetical contradiction is as follows, where E () denotes the set of all enumerations of the literal-occurrences in . – Boolean value 1 of a DNF cannot be PTIME-determined by any polynomial subset of E (). – However, every boolean-valued PTIME-computation of a DNF is PTIMEdetermined by a certain polynomial subset of E (). Now the next question is how to clarify the above loose description and formalize ‘PTIME-determined’ and ‘certain’ in strict mathematical terms. We assume that these notions are deﬁnable by induction on the complexity of computation, which is assumed to be parametric in the total number of states of the correlated Turing machine. Basic analysis and topology provide us with the intuitive background.

Proof Theory and Post-turing Analysis

133

The underlying proof idea is based on Baire-Borel-Lebesgue analytic approach, rather than Hilbert-Herbrand-Gentzen ﬁnitistic proof theory. To explain the point, let φ be any boolean two-valued PTIME-computable evaluation with the domain DNF. Loosely speaking, we ask how many solutions have the equations φ () = 1 and φ () = 0, rather than trying to redeﬁne a/o analyze φ within the traditional number theoretical framework. The latter approach seems to be extremely diﬃcult due to the underlying encoding problems (see above). To put the former more exactly, consider any mapping f : U → 2 = {0, 1} and let X := f−1 ({1}) and Y := f−1 ({0}). A desired hypothetical contradiction (see above) turns out to be relevant to Proposition 1. There is no covering – U=

i∈I

Oi =

s∈S

Os ∪

Ol

l∈L

such that the following 5 conditions hold. 1. 2. 3. 4. 5.

S∪L=I S∩L=∅ (∀i ∈ I) (Oi ⊆ X ∨ Oi ⊆ Y ) (∀l ∈ L) (Ol ∩ Y = ∅) Os ∪ Y = U s∈S

The main equation and the conditions 1-3 should express that Os for s ∈ S and Ol for l ∈ L are respectively “small” and “large” inverse neighborhoods of the values ∈ 2. One can view Os and Ol as having measure 0 and > 0, respectively. The conditions 4 and 5 should express that X is both “nowhere dense” and “of the second category”, respectively. Proof. Otherwise, let u ∈ U \

be ﬁxed, by 5. Since u ∈ / Y , i.e. Os ∪ Ol , there exists f (u) = 0, we have f (u) = 1, i.e. u ∈ X. Since U = s∈S

Os ∪ Y

s∈S

l∈L

a l ∈ L such that u ∈ Ol . Thus u ∈ Ol ∩ X, and hence Ol ⊆ X, by 3. However Ol ∩ Y = ∅, by 4, and hence X ∩ Y = ∅ - a contradiction, Q.E.D. Summary 2 We wish to infer the desired hypothetical conclusion P < NP from this proposition for a suitable U ⊆ DNF and f = φ, while assuming that φ () = 1 ⇔ ∈ TAUdnf . The neighborhoods Os and Ol satisfying 1-5 should arise by recursion on the number of states of the Turing machine M correlated with φ (abbr.: !M !). Basic case !M ! = 2 is easy (Section 5.3 below). Formalization of the recursive step is more involved. To this end, we describe a new hierarchy of PTIME-computable functions that is parametric in !M ! (Section 4, especially 4.2.3 below). This work might be of interest regardless of the present context (see also ﬁrst part of this introduction). The rest is yet to be elaborated.

134

2

L. Gordeew

Basic Deﬁnitions

In this section, we revise Post-Turing concept of a human computation (see [P, Tu]). Notation 3 As compared to more familiar presentations, we strictly distinguish between tapes and machines proper. We regard a given Turing machine as a pair "T, M # consisting of tape T and machine proper M . Moreover, M determines the corresponding computation as a partial function ΦM ∈ [T T] where T is the correlated tape space. By N and Z we denote the natural numbers and the > integers, respectively, and put N≤ n := {x ∈ N | x ≤ n} and Nn := {x ∈ N | x > n} for any n ∈ N. Generally, by [X → Y ] and [X Y ] we denote the set of all total functions and all partial functions from X to Y , respectively. Moreover, for any f ∈ [X Y ] and x ∈ X, we denote by Dom (f) the domain of f, and express by f (x) ↓ and f (x) ↑ the conditions (∃y ∈ Y ) f (x) = y and (∀y ∈ Y ) f (x) = y, respectively. Thus Dom (f) = {x ∈ X | f (x) ↓} ⊆ X. 2.1

The Tape Space T

Consider a ﬁxed ﬁnite set {0} ⊆ A ⊂ N, and let A0 = A ∩ N> 0 . A is called the alphabet, the elements of A0 are called the (g¨odelnumbers of) letters, 0 being the canonical number of the empty character ∅. With every tape T in the alphabet A (abbr.: A-tape) is correlated its display function ϕT ∈ [Z →A] whose values are characters printed on T . That is, ϕT (0) is the character printed in the distinguished start/stop cell labelled by and, generally, ϕT (z) is the character printed in |z|th cell to the right (left) of if z > 0 (z < 0). Moreover, we assume that # {z ∈ Z | ϕT (z) = 0} < ∞. Thus every ϕ ∈ [Z → A] with # {z ∈ Z | ϕ(z) = 0} < ∞ uniquely determines a A-tape T with ϕ = ϕT . For brevity, in the sequel we drop subscripts ‘A’ and ‘T ’ . Now for any d ∈ N we set: – T(d) := {ϕ ∈ [Z → A] | (∀z ∈ Z) ((z ≤ −d ∨ z ≥ d) → ϕ (z) = 0)} – T := T(d) thus being isomorphic to the space of all A-tapes.1 d∈N

← − − → For any a, b ∈ N, by 0 , ϕ (−a) , ..., ϕ (0) , ..., ϕ (b) , 0 we denote a ϕ ∈ T such ← → that (∀z ∈ Z) ((z < −a ∨ z > b) → ϕ (z) = 0). The tape 0 := λz.0 is called ← → empty; thus ϕ ∈ T(0) ⇔ ϕ = 0 .

1

Generally, we adopt traditional constructive realizability-interpretation of indexed sums according to which x ∈ Yi is understood as x ∈ Yf (x) ∧ f (x) ∈ I, for a given i∈I

ﬁxed algorithm f . This subtle distinction is not important for the contents, though, since we consider only recursive functions a/o functionals.

Proof Theory and Post-turing Analysis

2.2

135

The Computation ΦM ∈ [T T]

M -syntax. 1. Consider a ﬁxed ﬁnite set {0, 1} ⊆ S ⊂ N, a metasymbol ‘ﬁll-in’ ∈ / N, and let S − = S{1} and A+ = A ∪ {}. The pair "A+ , S# is called the vocabulary of a Turing machine M under consideration. The elements of S and S − are called states and workstates (of the machine), while the elements of A0 , A and A+ are called letters, characters and protocharacters (of the alphabet), respectively. It is assumed that 0 and 1 correspond to the initial and the ﬁnal state of M , respectively. 2. Regard M as a partial ﬁnite function, as follows M ∈ [A × S − {−1, 0, 1} × A+ × S] whose graph is a ﬁxed ﬁnite set of orders viewed as term-rewrite rules "a, α# +→ M (a, α) = "∆ (a, α) , Π (a, α) , Σ (a, α)# which split into the three speciﬁcations, where a, b ∈ A, α ∈ S − , β ∈ S: a) "a, α# +→ "0, b, β# “rewrite a to b and change α to β”, b) "a, α# +→ "1, , β# “move one cell to the right, change α to β and ﬁll ”, c) "a, α# +→ "−1, , β# “move one cell to the left, change α to β and ﬁll ”. The left- and right-hand parts of a term-rewrite rule are called redex (= argument) and contractum (= value), respectively. Note that, by the functional uniformity of M , equal redexes have equal contracta. Hence ∆ (a, α), Π (a, α) and Σ (a, α) are uniquely determined by every "a, α# ∈ Dom (M ). Thus ∆ ∈ [Dom (M ) → {−1, 0, 1}], Π ∈ [Dom (M ) → A+ ] and Σ ∈ [Dom (M ) → S]. M -semantics. 1. A machine M starts when in the state 0 while scanning the cell of the input A-tape ϕ. Every single computation step n is uniquely determined by the above intended interpretation of the uniquely determined order whose redex "a, α# coincides with the second component of the scanned position "0, "a, α## of the cell , whose g¨odelnumber is 0, provided that such order exists. To put it more precisely, let ϕn be the A-tape obtained at step n. Consider printed positions as pairs "z, ϕn (z)#, where z ∈ Z, and let the scanning position be the triplet "0, "ϕn (0) , σn ##, where σn ∈ S is the state symbol obtained at the computtion step n. Moreover, we always assume σ0 = 0. Now if ϕn (0) = a and σn = α then the computation step n + 1 according to the order "a, α# +→ "∆ (a, α) , Π (a, α) , Σ (a, α)# rewrites every printed position "z, ϕ (z)# to "z, ϕn+1 (z)#, and the scanning position "0, "ϕn (0) , σn ## to "0, "ϕn+1 (0) , σn+1 ##, such that ϕn+1 (z) := Π (a, α) if ∆ (a, α) = 0 and z = 0, else := ϕn (z + ∆ (a, α)), while σn+1 := Σ (a, α). The machine keeps executing these computation steps so long as possible. The output is stipulated by cases, as follows. Either the machine arrives at the last computation step s in the scanning position "0, "ϕs (0) , σs ## from which no further step

136

L. Gordeew

can be made, or else the computation never terminates. In the former case, there are two subcases depending on whether or not σs coincided with 1. Namely, if σs = 1 then the computation is over and the output A-tape is ϕs . In the remaining subcase, and in the latter case, the output is undeﬁned. 2. For any given A and S, as above, every machine M with vocabulary "A+ , S# thus uniquely determines the required computing mapping (or just computation) ΦM ∈ [T T]. Namely, for any given input ϕ ∈ T, we let ΦM (ϕ) ∈ T be the correlated output, as above, if it is deﬁned. Below we express this deﬁnition in more formal terms. ϕmin{n | σn =1} , if ∃n (σn = 1) 3. Let ΦM (ϕ) := undeﬁned, otherwise where σn ∈ S, ϕn ∈ T arise as follows by simultaneous recursion on n ∈ N. a) σ0 := 0 and ϕ0 := ϕ b) σn+1 := Σ (ϕ n (0) , σn ), iﬀ "ϕn (0) , σn # ∈ Dom (M ) Π (ϕn (0) , σn ), if z = 0 , c) ϕn+1 (z) := ϕn (z), if z = 0 iﬀ "ϕn (0) , σn # ∈ Dom (M ) and ∆ (ϕn (0) , σn ) = 0 d) ϕn+1 (z) = ϕn (z + ∆ (ϕn (0) , σn )), iﬀ "ϕn (0) , σn # ∈ Dom (M ) and ∆ (ϕn (0) , σn ) = 0 First normal form. We revise 2.2.2.3 in functional terms. To this end, we introduce two auxiliary functionals + ∈ [T×S − T×S] (recursion), , ∈ − T × S ×N T×S (induction) and for any E0 , ..., Ek , i ≤ k, denote by i ∈ [E0 ×... × Ek → Ei ] the ith Cartesian component of E0 ×... × Ek . Thus in particular for any ϕ, α we have 0 (ϕ, α) = ϕ and 1 (ϕ, α) = α. The whole deﬁnition runs as follows. 1. Deﬁne + ∈ [T×S − T×S] by setting Dom (+) := {"ϕ, α# ∈ T×S − | "ϕ (0) , α# ∈ Dom (M )} and + (ϕ, α) := +∆(ϕ(0),α) (ϕ, α), where: Π (ϕ (0) , α), if z = 0 , Σ (ϕ (0) , α) , a) +0 (ϕ, α) := λz. ϕ (z), if z = 0 provided that "ϕ (0) , α# ∈ Dom (M ) and ∆ (ϕ (0) , α) = 0 b) +d (ϕ, α) := "λz.ϕ (z + d) , Σ (ϕ (0) , α)#, provided that "ϕ (0) , α# ∈ Dom (M ) and ∆ (ϕ (0) , α) = d = 0 2. Deﬁne , ∈ T × S − ×N T×S by setting Dom (,) :=     "ϕ, α, n# ∈ T × S − ×N | (∀m ≤ n) +(...+ (ϕ, α) ...) ∈ Dom (+)   m , (ϕ, α, 0) := "ϕ, α# and , (ϕ, α, n + 1) := + (, (ϕ, α, n)), iﬀ deﬁned 3. Call the following equation the ﬁrst normal form of ΦM ∈ [T T]. 0 , ϕ, 0, min n ∈ N | 1 (, (ϕ, 0, n)) = 1 , if deﬁned ΦM (ϕ) = undeﬁned, otherwise Hence Dom (Φ ) := M ϕ ∈ T | (∃n ∈ N) "ϕ, 0, n# ∈ Dom (,) ∧ 1 (, (ϕ, 0, n)) = 1

Proof Theory and Post-turing Analysis

3

137

The Recursion on the Number of States

In this section, we wish to redeﬁne previous semantic deﬁnitions of ΦM ∈ [T T] by recursion on the state-rank !M !, where !M ! := #(S) is the total number of states of the underlying machine M . 3.1

Loose Description

We assume that the initial case refers to M having only two states 0 and 1. The correlated initial mapping ΦM ∈ [T T] is understood as in 2.2 above - so far no revision is required. Consider the recursion step. Suppose # (S) = p = q + 1 > 2, and let τ = max (S). Consider the correlated mapping ΦM ∈ [T T]. In the sequel we abbreviate by (α +→) and (+→ α), respectively, any order whose redex state is α, but the contractum state in not α, and any order whose contractum state is α, but the redex state is not α, while by (α) and (α +→ α), respectively, we’ll denote any order whose either redex or contractum state is α and any order whose redex and contractum states are both α. Now consider the (not necessarily disjunct) decomposition – M = N0 ∪ N1 ∪ N2 ∪ N3 where N0 , N1 , N2 , N3 arise from M by respectively deleting: 1. 2. 3. 4.

all all all all

orders orders orders orders

(τ ) and (τ +→ τ ) (τ +→), (τ +→ τ ) and (+→ 1) (0) and (0 +→ 0) (0 +→), (0 +→ 0) and (+→ 1)

We replace each Ni , i < 4, by a suitable machine Mi in the same alphabet A, whose set of states is S τ := S{τ }. Now each Mi arises by renaming some states in the orders of Ni , for the sake of τ -elimination. Loosely speaking, we treat τ as a new 0. Renaming (α +→) (or (+→ α) , (α) , (α +→ α)) by (β +→) (or (+→ β) , (β) , (β +→ β)) is understood literally as rewriting every stateoccurrence α under consideration to β. The renaming in question is speciﬁed with respect to the above clauses 1-4, i.e. Mi corresponding to the clause i + 1: 1. 2. 3. 4.

no renaming required, hence M0 = N0 rename every (+→ τ ) by (+→ 1) rename every (τ ) | (τ +→ τ ) by (0) | (0 +→ 0), respectively rename every (τ ) | (τ +→ τ ) | (+→ 0) by (0) | (0 +→ 0) | (+→ 1), respectively

Obviously !Mi ! = # (S τ ) = q < !M ! holds for all i < 4. Hence by the recursion, with every Mi , i < 4, we can correlate the appropriate functional description of the corresponding mapping Φi := ΦMi ∈ [T T]. This enables us to revise, in the functional terms, previous semantic deﬁnition of the mapping ΦM . Namely, it is readily seen that every input ϕ ∈ T uniquely determines ΦM (ϕ) ∈ T as a composition of the either form:

138

L. Gordeew

Φ0 (ϕ), Φ1 ◦ Φ2 (ϕ), Φ1 ◦ Φ3 ◦ Φ0 (ϕ), Φ1 ◦ Φ3 ◦ Φ1 ◦ Φ2 (ϕ), 2 Φ1 ◦ Φ3 ◦ Φ1 ◦ Φ3 ◦ Φ0 (ϕ) = (Φ1 ◦ Φ3 ) ◦ Φ0 (ϕ), 2 Φ1 ◦ Φ3 ◦ Φ1 ◦ Φ3 ◦ Φ1 ◦ Φ2 (ϕ) = (Φ1 ◦ Φ3 ) ◦ Φ1 ◦ Φ2 (ϕ), etc., where we put Φi ◦ Φj ◦ ... ◦ Φk ◦ Φl (ϕ) = Φl (Φk (...Φj (Φi (ϕ)) ...)) and n (Φi ◦ ... ◦ Φj ) (ϕ) = (Φi ◦ ... ◦ Φj ) ◦ ... ◦ (Φi ◦ ... ◦ Φj ) (ϕ). n times

3.2

Explanation

Let ϕ be any given input tape. Let be a given machine M with a distinguished state symbol τ ∈ / {0, 1}. Suppose ΦM (ϕ) ↓, and consider the process of computing the output ΦM (ϕ). Recall that for any n we denote by σn the state symbol of the scanning position at computation step n. First suppose that we arrived at ﬁnal step s with σs = 1 such that (∀n < s) σn = τ . Then we have ΦM (ϕ) = ΦM0 (ϕ), i.e. the output can just as well be obtained by using instead of M the machine M0 that arises by dropping all orders containing state symbol τ , which yields !M0 ! < !M !. Otherwise, let m0 := min {n < s | σn = τ }, and consider partial result ϕm0 obtained at step m0 . Since m0 yields the ﬁrst occurrence of τ , while in form (+→ τ ) and in the absence of (+→ 1), we have ϕm0 = ΦM1 (ϕ), where M1 arises by rewriting in N1 ⊆ M every (+→ τ ) to the corresponding (+→ 1), which by deﬁnition of N1 yields !M1 ! < !M !. Consider the rest of computation. First suppose that in the remainder we don’t use state symbol 0, i.e. (∀n : m0 < n < s) σn = 0. Then we can pass from ϕm0 to the output ΦM (ϕ) by using instead of M the machine M2 that arises by rewriting in N2 ⊆ M every state-occurrence τ by 0. This obviously yields !M2 ! < !M !, while being admissible by deﬁnition of N2 . Summing up, in this case we have ΦM (ϕ) = ΦM2 (ϕm0 ) = ΦM2 (ΦM1 (ϕ)) = ΦM1 ◦ΦM2 (ϕ). Otherwise, let m1 := min {m0 < n < s | σn = 0} and consider partial result ϕm1 obtained at step m1 . Since m1 provides us with the ﬁrst occurrence of 0, while in form (+→ 0) and in the absence of (+→ 1) and , we have ϕm1 = ΦM3 (ϕm0 ), where M3 arises from M by rewriting in N3 ⊆ M every state-occurrence τ by 0, while simultaneously replacing (+→ 0) by (+→ 1). This obviously yields !M3 ! < !M !, while being admissible by deﬁnition of N3 . Suppose that state symbol τ does not occur in the rest of computation. Then we can safely replace there M by M0 (see above), which yields ΦM (ϕ) = ΦM0 (ϕm1 ) = ΦM0 (ΦM3 (ϕm0 )) = ΦM0 (ΦM3 (ΦM1 (ϕ))) = ΦM1 ◦ ΦM3 ◦ ΦM0 (ϕ). Otherwise, we take the ﬁrst remaining occurrence of state symbol τ and ask if state symbol 0 occurs in the remainder. If this is not the case, by previous argument we arrive at ΦM (ϕ) = ΦM1 ◦ ΦM3 ◦ ΦM1 ◦ ΦM2 (ϕ). Otherwise, we take the ﬁrst remaining occurrence of state symbol 0 and ask if state symbol τ occurs in the remainder, and so on. As a whole, this yields a recursion with entails iterated compositions n (ΦM1 ◦ ΦM3 ) followed either by ΦM0 or ΦM1 ◦ ΦM2 - as shown in 3.1. In 3.3

Proof Theory and Post-turing Analysis

139

below we just formalize previous description - note that ζM (ϕ, i) corresponds to mi , while ιM (ϕ, i) being the index of the correlated machine Mι . One can also view it as a ﬁnite automaton2 , where ‘q’ denotes the critical state τ :

0 1 3

0 2

1

q Fig. 1. A graph of the automaton

3.3

More Precise Description

Characteristic functions. For any given machine M , we deﬁne the auxiliary partial state function σM ∈ [T × N S] by setting σM (ϕ, n) := σn where σn arises as in 2.2.2.3 with respect to ϕ. Furthermore, for any i < 4 and the adjacent Mi , Φi , i < 4 (see 3.1 above), we deﬁne one partial index function ιM ∈ [T × N {0, 1, 2, 3}] and one partial time function ζM ∈ [T × N N> 0] by simultaneous recursion, as follows, where as above τ = max (S), etc. (For brevity we’ll often drop the subscript ‘M ’ and dummy variable ‘ϕ’ in σM (ϕ, n), ιM (ϕ, n) and ζM (ϕ, n).)    0, if (∃n > 0) (σ(n) = 1 ∧ (∀m : 0 < m < n) σ(m) = τ ) 1. ιM (ϕ, 0) := 1, if (∃n > 0) σ(n) = τ   otherwise undeﬁned min {n > 0 | σ(n) = τ }, if ι (0) = 1 2. ζM (ϕ, 0) := otherwise undeﬁned  ι (i) = 3 ∧ (∃n > ζ (i))   0, if   (σ(n) = 1 ∧ (∀m : ζ (i) < m < n) σ(m) = τ )     1, if ι (i) = 3 ∧ (∃n > ζ (i)) σ(n) = τ 3. ιM (ϕ, i + 1) :=  ι (i) = 1 ∧ (∃n > ζ (i))   2, if   (σ(n) = 1 ∧ (∀m : ζ (i) < m < n) σ(m) = 0)    3, if ι (i) = 1 ∧ (∃n > ζ (i)) σ(n) = 0  min {n > ζ (i) | σ(n) = τ }, if ι (i + 1) = 1   4. ζM (ϕ, i + 1) := min {n > ζ (i) | σ(n) = 0}, if ι (i + 1) = 3   otherwise undeﬁned 2

This idea was due to Andreas Krebs.

140

L. Gordeew

Length function and recursive With any given M we correlate expansion. : its partial length function 5M ∈ T N> 0 1. 5M (ϕ) := min {n | ιM (ϕ, n) ∈ {0, 2}}, iﬀ deﬁned. (For brevity, we’ll often drop the subscript ‘M ’ .) 2. Having this, we obtain the following recursive expansion of ΦM . ΦM (ϕ) = Φι(ϕ,0) ◦ ... ◦ Φι(ϕ,(ϕ)) (ϕ), iﬀ deﬁned. 3. To put it in a more transparent form, we have (q+1)

Φ (ϕ) = M

[ 1 (ϕ)]  (q)  Φ(q) ◦ Φ(q) 2 iﬀ ι(ϕ, 5 (ϕ)) = 0 ◦ Φ0 (ϕ), 1 3 1

(ϕ) −1 ]  (q) (q)  Φ(q) ◦ Φ(q) [ 2 ◦ Φ1 ◦ Φ2 (ϕ), iﬀ ι(ϕ, 5 (ϕ)) = 2 1 3 where the superscripts ‘(q+1)’ and ‘(q)’ refer to the number of states of M and Mi , respectively. This expansion will be further speciﬁed in the next section.

4

Transitive Normal Forms

We wish to prolong the recursive expansion 3.3.2.3 in order to obtain explicit functional expansion of ΦM referring to the computations of the smallest staterank 2. Notation 4 Basically, we wish to regard ΦM as a functional composition whose components are basic computations of the state-rank 2, possibly decorated a/o extended by auxiliary combinatorial operations. It is assumed that all these components are eﬀectively determined by M . 4.1

Transitive Recursive Expansion

We wish to eliminate the index and length functions which ﬁgure in the recur(p) sive expansion 3.3.2.3. Let p = !M !. We " the transitive ! replace ΦM = ΦM by (p)

functional computation ΨM = ΨM ∈ (p)

(p,p)

(q,r)

≤ T × N≤ p ×N → T × Np . To this end, (2,r)

we ! let ΨM := ΨM " , where ΨM ! is deﬁned for all q ≤ r" such that ΨM ∈ (q,r) ≤ ≤ ≤ and ΨM ∈ T × N≤ if q > 2, while also T × N≤ r → T × Nr r ×N → T × Nr (q,r) (q,r) ≤ ∈ N≤ using two auxiliary combinatorial functionals Q0 , Q1 r → Nr where (s,r) (s,r) q < r. Furthermore, for the sake of brevity, with any F ∈ ΨM , Qι we ! " ≤ ≤ # ∈ T × N ×N → T × N ×N by setting F # (ϕ, i, t) := "ψ, j, t# or correlate F r r := "ϕ, j, t# such that "ψ, j# = F (ϕ, i), "ψ, j# = F (ϕ, i, t) or j = F (i), respectively. The main deﬁnition runs by recursion on p ≥ 2, as shown below, where (q,r) the subscripts ‘i’ in Ψ#i for i < 4 refer to Mi being deﬁned as above via the decomposition M = N0 ∪ N1 ∪ N2 ∪ N3 .

Proof Theory and Post-turing Analysis

141

" ! ≤ by setting ∈ T × N≤ r → T × Nr  "ϕ, i#, if i = 1  $ % (2,r) 3 (2) (2) ΨM (ϕ, i) := ΦM (ϕ) , 2 , if ΦM (ϕ) ↓  , if i = 1  "ϕ, i#, otherwise ≤ (q,r) (q,r) ≤ 2. Let Q0 , Q1 ∈ Nr → Nr by setting: i, if i = q (q,r) a) Q0 (i) := i + 1, if i = q  / {1, q}  i, if i ∈ (q,r) b) Q1 (i) := 0, if i = 1  1, if i = q " ! (q+1,r) ≤ 3. If p = q + 1 > 2 then let ΨM by setting: ∈ T × N≤ r ×N → T × Nr (2,r)

1. Let ΨM

(q+1,r)

(ϕ, i, t) := "ϕ, i# a) If i = 1 then ΨM (q+1,r) (ϕ, 1, 0) := "ϕ, 0# b) ΨM (q+1,r) (ϕ, 1, t) := c) If t > 0 then ΨM

t (q,r) # (q,r) ◦ Ψ#(q,r) ◦ Q # (q,r) ◦ Ψ#(q,r) ◦ Q # (q,r) ◦ Ψ#(q,r) ◦ Q # (q,r) (ϕ, 1, t) Ψ#0 ◦Q 0 1 1 2 0 3 1 These equations we refer to as the transitive recursive expansions of ΨM . According to the intended interpretation, t is a “global-time parameter” approximating length functions occurring in all recursive expansions 3.3.2 (p) which participate in the ﬁnal composite expression of ΦM . (p) (p) 4. The relationship between ΨM and ΦM is as follows. Let t ∈ N0 and suppose (p) ΦM (ϕ) ↓. Then, by 3.3, we easily arrive at:

(p) (p) (p) a) 1 ΨM (ϕ, 1, t) = p ⇔ 0 ΨM (ϕ, 1, t) = ΦM (ϕ)

(p) (p) (p) b) ΦM (ϕ) = 0 ΨM ϕ, 1, min t ∈ N | 1 ΨM (ϕ, 1, t) = p

(p) (p) c) ΦM (ϕ) = 0 ΨM (ϕ, 1, t) , if t ≥ min n ∈ N | 1 (, (ϕ, 0, n)) = 1 4.2

Explanation

To illuminate the method, consider ﬁrst non-trivial case p = 3. By deﬁnition 4.1.3 (c) we have (3)

(3,3)

ΨM (ϕ, 1, t) = ΨM (ϕ, 1, t)

t (2,3) # (2,3) ◦ Ψ#(2,3) ◦ Q # (2,3) ◦ Ψ#(2,3) ◦ Q # (2,3) ◦ Ψ#(2,3) ◦ Q # (2,3) (ϕ, 1, t) ◦Q := Ψ#0 0 1 1 2 0 3 1

3

The whole deﬁnition-by-cases is decidable, since the underlying M has only two states (see also Remark 7 below).

142

L. Gordeew

This results in the following deﬁnition by cases. (2)

1. Suppose Φ0 (ϕ) ↓. Hence: $ % (2,3) (2) a) Ψ#0 (ϕ, 1, t) = Φ0 (ϕ) , 2, t

$ % # (2,3) Φ(2) (ϕ) , 2, t = Φ(2) (ϕ) , 3, t b) Q 0 0 0

$ % (2,3) (2) (2) Φ0 (ϕ) , 3, t = Φ0 (ϕ) , 3, t c) Ψ#1

$ % # (2,3) Φ(2) (ϕ) , 3, t = Φ(2) (ϕ) , 3, t d) Q 1 0 0 $ % (3,3) (2) e) etc., which yields ΨM (ϕ, 1, t) = Φ0 (ϕ) , 3, t (2)

2. Suppose Φ0 (ϕ) ↑. Hence: (2,3) (ϕ, 1, t) = "ϕ, 1, t# a) Ψ#0 # (2,3) (ϕ, 1, t) = "ϕ, 1, t# b) Q 0 (2) c) Suppose Φ1 (ϕ) ↑. Hence: (2,3) i. Ψ#1 (ϕ, 1, t) = "ϕ, 1, t# (2,3) # ii. Q1 (ϕ, 1, t) = "ϕ, 0, t# (2,3) iii. Ψ#2 (ϕ, 0, t) = "ϕ, 0, t# (2,3) # iv. Q0 (ϕ, 0, t) = "ϕ, 0, t# (3,3) v. etc., which yields ΨM (ϕ, 1, t) = "ϕ, 0, t# (2) d) Suppose Φ1 (ϕ) ↓. Hence: $ % (2,3) (2) i. Ψ#1 (ϕ, 1, t) = Φ1 (ϕ) , 2, t

$ % # (2,3) Φ(2) (ϕ) , 2, t = Φ(2) (ϕ) , 1, t ii. Q 1 1 1

(2) (2) iii. Suppose Φ2 Φ1 (ϕ) ↓. Hence:

$ % (2,3) (2) (2) (2) Φ1 (ϕ) , 1, t = Φ1 ◦ Φ2 (ϕ) , 2, t A. Ψ#2

$ % # (2,3) Φ(2) ◦ Φ(2) (ϕ) , 2, t = Φ(2) ◦ Φ(2) (ϕ) , 3, t B. Q 0 1 2 1 2

$ % (2,3) (2) (2) (2) (2) C. Ψ#3 Φ1 ◦ Φ2 (ϕ) , 3, t = Φ1 ◦ Φ2 (ϕ) , 3, t

$ % # (2,3) Φ(2) ◦ Φ(2) (ϕ) , 3, t = Φ(2) ◦ Φ(2) (ϕ) , 3, t D. Q 1 1 2 1 2 $ % (3,3) (2) (2) E. etc., which yields ΨM (ϕ, 1, t) = Φ1 ◦ Φ2 (ϕ) , 3, t

(2) (2) iv. Suppose Φ2 Φ1 (ϕ) ↑. Hence:

$ % (2,3) (2) (2) Φ1 (ϕ) , 1, t = Φ1 (ϕ) , 1, t A. Ψ#2

$ % # (2,3) Φ(2) (ϕ) , 1, t = Φ(2) (ϕ) , 1, t B. Q 0 1 1

(2) (2) C. Suppose Φ3 Φ1 (ϕ) ↑. Hence:

$ % (2,3) (2) (2) 1. Ψ#3 Φ1 (ϕ) , 1, t = Φ1 (ϕ) , 1, t

$ % # (2,3) Φ(2) (ϕ) , 1, t = Φ(2) (ϕ) , 0, t 2. Q 1 1 1 % $ (2) (3,3) 3. etc., which yields ΨM (ϕ, 1, t) = Φ1 (ϕ) , 0, t

Proof Theory and Post-turing Analysis

143

(2) (2) D. Suppose Φ3 Φ1 (ϕ) ↓. Hence: %

$ (2) (2,3) (2) (2) 1. Ψ#3 Φ1 (ϕ) , 1, t = Φ1 ◦ Φ3 (ϕ) , 2, t

$ % # (2,3) Φ(2) ◦ Φ(2) (ϕ) , 2, t = Φ(2) ◦ Φ(2) (ϕ) , 1, t 2. Q 1 1 3 1 3

(2) (2) (2) 3. Suppose Φ0 Φ1 ◦ Φ3 (ϕ) (ϕ) ↓, etc. (see 1 above).

(2) (2) (2) 4. Suppose Φ0 Φ1 ◦ Φ3 (ϕ) (ϕ) ↑, etc. (see 2 above). 4.3

PTIME Normal Form

Suppose M is a PTIME-machine of polynomial degree m ∈ N> 0 . That is, Dom (ΦM ) = T, i.e. ΦM (ϕ) ↓ holds for every ϕ ∈ T; furthermore, for any ϕ ∈ T(d) m the computation of ΦM (ϕ) requires ≤ (2d − 1) steps. Hence by the ﬁrst normal form (2.2.3) we have m 1. (∀d ∈ N> 0 ) ∀ϕ ∈ T(d) min n ∈ N | 1 (, (ϕ, 0, n)) = 1 ≤ (2d − 1) 2. From this, by 4.1.4, we arrive at the following PTIME-characteristic equations, where as above p = !M !, d ∈ N> 0 and ϕ ∈ T(d) . m a) ΦM (ϕ) = 0 (ΨM (ϕ, 1, (2d − 1) )) m b) p = 1 (ΨM (ϕ, 1, (2d − 1) )) In the remainder of this section we use the transitive recursive expansions (4.1.3) in order to obtain the correlated explicit normal form of an arbitrary PTIME-computation ΦM . This normal form provides us with the desired hierarchy of PTIME-computable recursive functions which is parametric in the number of states !M ! of the underlying Turing machines. To this !end, it will suﬃce to "complete the recursive deﬁnition of (p) (s,p) ≤ & we correlate F ΨM = Ψ M ∈ T × N ≤ p ×N → T × Np . With F = Qι ! " ≤ & ∈ T × N≤ p → T × Np by setting F (ϕ, i) := "ϕ, F (i)#. The deﬁnition runs as (2,p)

follows, where composed subscripts ‘i1 ... in ’ in Ψi1 ... in refer to the corresponding iterated decompositions of the shape (... (Mi1 ) ...)in ; moreover, for the & (2,p) ◦ ... ◦ Q & (s,p) . sake of brevity, we drop ‘◦’ in the functional compositions Q j2 js 1 Moreover, we set mod (x) := x − 2 2 x . 3. Conclusion. We revise the operator ΨM . Suppose p = !M !, t ∈ N> 0 , d ∈ N0 , ϕ ∈ T(d) . It is not diﬃcult to veriﬁed, by tedious calculations, that one can rewrite ΨM , and hence ΦM , by 4.3.2, to the desired PTIME normal form: (p) (p) (p) a) ΨM (ϕ, i, t) = Υ0 ◦ Υ1 ◦ ... ◦ Υ8·4p−3 tp−2 −1 (ϕ, i)

(p) (p) (p) b) ΦM (ϕ) = 0 Υ0 ◦ Υ1 ◦ ... ◦ Υ8·4p−3 (2d−1)m(p−2) −1 (ϕ, 1) " ! (p) ≤ is deﬁned as follows. where each Υν ∈ T × N≤ p → T × Np i. If p = 3 then 8t > ν = 8k1 + k0 where k0 < 8, k1 < t and  (2,3) Ψ1k , if k0 ∈ {0, 2, 4, 6} (3) 2 0 Υν := & (2,3) 1 Q , if k0 ∈ {1, 3, 5, 7} mod( 2 (k0 −1))

144

L. Gordeew

ii. If p > 3 then 8 · 4p−3 tp−2 > ν = 8 · 4p−3 tp−3 k2(p−3)+1 + 8 · 4p−4 tp−3 k2(p−3) + ... + 8 · 4tk3 + 8tk2 + 8k1 + k0 where k0 < 8, k1 < t, k2(j+1) < 4, k2(j+1)+1 < t. We set t = r + 1 and (p) Υν :=  (2,p)  Ψk : k0 ∈ {0, 2, 4, 6} 1  2(p−3) ...k2 2 k0     & (2,p) 1  : k0 ∈ {1, 3, 5} Q   mod( 2 (k0 −1))      k0 = 7∧ (2,p)  &  : Q  1  k1 , k3 , ..., k2(p−3)−1 < r       k0 = 7∧   (2,p) (3,p) Q & &  k1 = r∧  : Q  1 1 mod( 2 (k2 −1))    k3 , ..., k2(p−3)−1 < r    ... ... ...     ...       Q & (2,p) Q & (s,p) 1 & (3,p) 1  ...Q  1 (k −1) mod mod( 2 (k2(s−2) −1))  ( ) 2 2       ...     ...     ...      & (2,p) Q & (p−1,p) & (3,p) 1 Q ...Q 1 mod( 2 (k2 −1)) mod( 12 (k2(p−3) −1))

... ... 

k0 = 7∧ : k1 = ... = k2(s−2)−1 = r∧ k2(s−2)+1 , ..., k2(p−3)−1 < r ... ... ... k = 7∧ : 0 k1 = ... = k2(p−3)−1 = r

Example 5. If p = 4 then 8 · 4t2 > ν = 8 · 4tk3 + 8tk2 + 8k1 + k0 , where k0 < 8, k1 < t, k2 < 4, k3 < t and  (2,4)  Ψk ◦ 1 k , if k0 ∈ {0, 2, 4, 6}   2 2 0     & (2,4) 1 Q , if k0 ∈ {1, 3, 5} mod( 2 (k0 −1)) (4) Υν :=  & (2,4) ,  if k0 = 7 ∧ k1 = t − 1 Q 1    (2,4) (3,4) Q & &  , if k0 = 7 ∧ k1 = t − 1 ◦Q 1 mod( 12 (k2 −1))

5

Topological Considerations

As mentioned above (see Introduction), we wish to get more insight into the structure of φ−1 ({0}) and φ−1 ({1}) for any boolean-valued PTIME-computable function φ. To this end, according to 2.2 (see above) we ﬁrst of all let φ := ΦM . It remains to deﬁne boolean values in T. Now suppose 1, 2 ∈ A0 and set 0 := 1 , 1 := 2 , where for any b ∈ A0 we denote by b a singleton b, if z = 0 λz. ∈ T. Such b are called discrete tapes. Generally, any ΦM 0, if z = 0

Proof Theory and Post-turing Analysis

145

such that (∀ϕ ∈ U ⊆ T) (∃b ∈ B ⊆ A0 ) ΦM (ϕ) = b is called discrete-valued for U in B. So,

loosely speaking, we wish to study topological structure of the −1 ⊆ T for arbitrary PTIME-discrete-valued computations ΦM . b sets ΦM To this end, the recursion on the number of states of M (see Section 4 above) will provides us with the natural parameter !M !. Basic case !M ! = 2 is easy and straightforward (see 5.3 below), but more complex computations ΦM where !M ! > 2 require special techniques referring to more complicated sets Z ⊆ T and Φ−1 M (Z) ⊆ T. 5.1

Basic Notions

1. For any r ∈ N and ϕ, ψ ∈ T, let ϕ ≡r ψ :⇔ (∀z ∈ Z) (−r ≤ z < r → ϕ (z) = ψ (z)). 2. For any µ, ν ∈ N, b−µ , ..., b0 , ..., bν ∈ A and x−µ , ..., x0 , ..., xν ∈ N0 , denote x−µ #x0 ...b0 ...bxν ν a tape ϕ ∈ T such that: by b−µ ) ) a) ϕ (z) = 0, if z ≥ xi or z < x0 − xi 0≤i≤ν 0≤i≤µ + * ) b) ϕ u − xj + xi = bj , if 0 ≤ j ≤ ν and 0 ≤ u < xj 0≤i≤j + * ) c) ϕ −u + x0 − x−i = b−j−1 , if 0 ≤ j < µ and 0 < u ≤ x−j 0≤i≤j

That is to say,

x0 x−µ b−µ ...b#0 ...bxν ν

has the shape

← − − → 0 , b−µ , ..., b−µ , ..., b0 , ..., b0 , ..., bν , ..., bν , 0 x−µ

x0

xν

where the leftmost occurrence of b0 is printed in the cell . For brevity, ’ ‘1’ , which are seen from we’ll often drop exponents (·) , and decorations ‘ (·) the context; thus b = # b1 for µ = ν = 0, x0 = 1. 3. For any$ µ, ν ∈ N and b−µ % , ..., b0 , ..., bν ∈ A, call a µ, ν-skeleton a decorated # tuplet b−µ , ..., b0 , ..., bν such that the following conditions hold.4 a) (∀ι : −µ ≤ ι < ν ∧ ι = −1) bι = bι+1 b) bν = 0 ⇒ ν = 0 c) b−µ = 0 ⇒ µ = 0 Denote by Sµ,ν the set of all µ, ν-skeletons and let S := Sµ,ν . We say µ,ν∈N % % $ $ S = b −θ , ..., b# 0 , ..., b ϑ ∈ Sθ,ϑ extends S = b−µ , ..., b#0 , ..., bν ∈ Sµ,ν iﬀ µ ≤ θ, ν ≤ ϑ and (∀ι : −µ ≤ ι < ν) bι = b ι .

4

One can also regard decorated tuplets

b−µ , ..., b0 , ..., bν

as abbreviations of the

ordinary tuplets b−µ , ..., 0, b0 , ..., bν , which uniquely determine the dimension ’ if either µ = 0 or ν = 0 is the case. µ, ν. We’ll often drop decorations ‘ (·)

146

L. Gordeew

x0 x−µ 4. If ϕ = b−µ ...b#0 ...bxν ν ∈ T and S =

$

b−µ , ..., b#0 , ..., bν

%

∈ Sµ,ν then S

is called the skeleton of ϕ, and "µ, ν# is called the dimension of both ϕ and µ+ν+1 S, while "x−µ , ..., x0 , ..., xν # ∈ (N0 ) is called the body of ϕ. Note that both the dimension and body are uniquely determined for every ϕ ∈ T. Denote by Tµ,ν the set of all ϕ ∈ T whose dimension is "µ, ν#. Obviously, ϕ ∈ T(d) ∩ Tµ,ν implies max (µ, ν) ≤ d. $ % 5. Call a µ, ν-environment a pair "S, X# such that S = b−µ , ..., b#0 , ..., bν ∈ µ+ν+1

Sµ,ν and X ⊆ (N0 ) and let E := Eµ,ν .

. Denote by Eµ,ν the set of all µ, ν-environments

µ,ν∈N

6. The correlated canonical embedding k ∈ [Eµ,ν →%℘ (T%µ,ν )] is stipulated as $$ follows. For any E = "S, X# = b−µ , ..., b#0 , ..., bν , X ∈ Eµ,ν we set x0 x−µ xν # b−µ ...b0 ...bν | "x−µ , ..., x0 , ..., xν # ∈ X ⊂ Tµ,ν . Note that k (E) := for every Ω ⊆ Eµ,ν , by deﬁnition k (Ω) = {k (E) | E ∈ Ω} ⊂ ℘ (Tµ,ν ). 7. For any r, µ, ν ∈ N and E ∈ E we set Φ M (r, µ, ν, E) := {O ∈ Eµ,ν | (∀ϕ ∈ k (O)) (∃ψ ∈ k (E)) ΦM (ϕ) ≡r ψ} ⊆ if ΦM is discrete-valued for U in B Eµ,ν . So in particular,

⊇ A, and b ∈ A0 , then Φ−1 = k Φ b (0, µ, ν, ""b# , {1}#) where obviM M µ,ν∈N

ously Φ M (0, µ, ν, ""b# , {1}#) = {O ∈ Eµ,ν | (∀ϕ ∈ k (O)) ΦM (ϕ) (0) = b}. 5.2

General Approach

Consider any natural number p ≥ 2, an alphabet A ⊇ {0, 1, 2} and the correlated tape space T. Let M be a PTIME-machine with the alphabet A such that !M ! = p. Arguing along the lines of Proposition 1 (see Introduction), we choose a suitable “large” ε ∈ N> , let U ⊆ T and suppose that ΦM is µ,ν 0 discrete-valued for U in B = {1, 2}. We set:

µ,ν≤ε

X := ϕ ∈ U | ΦM (ϕ) = 2 = Φ−1 M ({1}) ∩ U −1 Y := ϕ ∈ U | ΦM (ϕ) = 1 = ΦM ({0}) ∩ U We look for a suitable discrete covering – Ω (p) ⊆

(p)

such that: 1. k Ω (p) = U (p)

(p)

Eµ,ν that admits a suitable partition Ω (p) = ΩS ∪ ΩL

µ,ν≤ε

(p)

2. ΩS ∩ ΩL = ∅ ΦM (0, µ, ν, ""b# , {1}#) 3. Ω (p) ⊆ µ,ν≤εb∈B

Proof Theory and Post-turing Analysis (p)

147

(p)

We set Ω (p) = {Oi = ∅ | i ∈ I}, ΩS = {Os | s ∈ S}, ΩL = {Ol | l ∈ L} where S ∪ L = I and (by 2 above) S ∩ L = ∅. Moreover, for any Oi ∈ Ω (p) we let O i := k (Oi ). Hence – k Ω (p) = {Oi | i ∈ I} = {Os | s ∈ S} ∪ {Ol | l ∈ L} whichby 1-3 above yields – U= Oi = Os ∪ Ol i∈I

s∈S

l∈L

along with the ﬁrst 3 conditions of Proposition 1: 1. S ∪ L = I 2. S ∩ L = ∅ 3. (∀i ∈ I) (Oi ⊆ X ∨ Oi ⊆ Y ) We wish to further specify the desired covering Ω (p) in order to fulﬁll the (p) remaining two conditions 4, 5 of Proposition 1, provided that ΦM = ΦM is the hypothetical boolean evaluation on CNF. To this end, we argue by induction on p. The basis of induction does not require any estimate on the complexity (2) of ΦM = ΦM - this case is exposed in the next subsection. The induction step relies upon the recursive expansions of a PTIME-computation ΦM elaborated in Chapters 3, 4. (Note that being discrete-valued is not hereditary, in that if we (q+1) (q) pass from M to Mi and the adjacent discrete-valued computation ΦM to Φi (q) (see 3.1, 3.3 above) then Φi must not be discrete-valued.) Loosely speaking, the desired environments of Ω (q+1) for q > 1 arise from the environments of Ω (q) by a suitable polynomial iteration of the operation Φ M . The resulting pairs µ+ν+1 which can be loosely referred to "S, X# ∈ Ω (q+1) include sets X ⊆ (N0 ) as the solutions of the appropriate polynomial systems of polynomial equations (q+1) determined by Ω (q) , while the desired measurable partition Ω (q+1) = ΩS ∪ (q+1) ΩL is supposed to be determined by a natural Cartesian measure of X. 5.3

Basic Case

Proposition 6. Let !M ! = 2, b ∈ A0 , µ, ν ∈ N, ϕ ∈ Tµ,ν , and suppose that ΦM (ϕ) (0) = b. There exist ξ ∈ N and S ∈ S0,ξ ∪ Sξ,0 such that one of the 0 following conditions 1-6 holds, where for brevity we put (N> 0 ) := ∅ in 2 and 5. 1. ξ ≤ ν, S = "b0 , ..., bξ # ∈ S0,ξ and the following two conditions hold. % $ a) There exist S = b −µ , ..., b# 0 , ..., b ν ∈ Sµ,ν that extends S and x0 µ+ν+1 x ν x = "x−µ , ..., x0 , ..., xν # ∈ (N> such that ϕ = b−µ−µ ...b# 0 ...b x . ν 0) % $ , , ..., b ∈ Sθ,ϑ extending S and any b) For any S = b −θ , ..., b 0 ϑ θ+ϑ+1

x = "x−θ , ..., x0 , ..., xϑ # ∈ (N> ) , it holds

0 x x , 0 ...b xϑ (0) = b. ΦM b−θ−θ ...b 0 ϑ 2. ξ ≤ ν, S = "b0 , ..., bξ # ∈ S0,ξ and the following two conditions hold.

148

L. Gordeew

% $ a) There exist S = b −µ , ..., b# 0 , ..., b ν ∈ Sµ,ν that extends S and µ+ξ

x = "x−µ , ..., x0 , ..., xν # ∈ (N> 0)

ν−ξ

> × N> 1 × (N0 )

such that

x0

ν ϕ = b−µ−µ ...b# 0 ...b x . ν % $ , , ..., b ∈ Sθ,ϑ extending S and any b) For any S = b −θ , ..., b 0 ϑ

x

θ+ξ

ϑ−ξ

> ) × N> x = "x−θ , ..., x0 , ..., xϑ # ∈ (N> 1 × (N0 )

0 x x , 0 ...b xϑ (0) = b. ΦM b−θ−θ ...b 0 ϑ

, it holds

3. 0 < ξ ≤ ν, S = "b0 , ..., bξ # ∈ S0,ξ and the following two conditions hold. % $ a) There exist S = b −µ , ..., b# 0 , ..., b ν ∈ Sµ,ν that extends S and µ+ξ−1

x = "x−µ , ..., x0 , ..., xν # ∈ (N> 0)

ν−ξ+1

× {1} × (N> 0)

such that

x0

x ν ϕ = b−µ−µ ...b# 0 ...b x . ν % $ , , ..., b ∈ Sθ,ϑ extending S and any b) For any S = b −θ , ..., b 0 ϑ ϑ−ξ+1

θ+ξ−1

) × {1} × (N> x = "x−θ , ..., x0 , ..., xϑ # ∈ (N> 0)

0 x 0 x , ...b xϑ (0) = b. ΦM b−θ−θ ...b 0 ϑ

, it holds

4. ξ ≤ µ, S = "b−ξ , ..., b0 # ∈ Sξ,0 and the above conditions 1 (a), (b) hold. 5. ξ ≤ µ, S = "b−ξ , ..., b0 # ∈ Sξ,0 and the following two conditions hold. % $ a) There exist S = b −µ , ..., b# 0 , ..., b ν ∈ Sµ,ν that extends S and µ−ξ

x = "x−µ , ..., x0 , ..., xν # ∈ (N> 0)

ν+ξ

> × N> 1 × (N0 )

such that

x0 x ν ϕ = b−µ−µ ...b# 0 ...b x . ν % $ , , ..., b ∈ Sθ,ϑ extending S and any b) For any S = b −θ , ..., b 0 ϑ θ−ξ

ϑ+ξ

> ) × N> x = "x−θ , ..., x0 , ..., xϑ # ∈ (N> 1 × (N0 )

0 x x , 0 ...b xϑ (0) = b. ΦM b−θ−θ ...b 0 ϑ

, it holds

6. 0 < ξ ≤ µ, S = "b−ξ , ..., b0 # ∈ Sξ,0 and the following two conditions hold. % $ a) There exist S = b −µ , ..., b# 0 , ..., b ν ∈ Sµ,ν that extends S and µ−ξ+1

x = "x−µ , ..., x0 , ..., xν # ∈ (N> 0)

ν+ξ−1

× {1} × (N> 0)

such that

x0

x ν ϕ = b−µ−µ ...b# 0 ...b x . ν % $ , , ..., b ∈ Sθ,ϑ extending S and any b) For any S = b −θ , ..., b 0 ϑ θ−ξ+1

ϑ+ξ−1

) × {1} × (N> x = "x−θ , ..., x0 , ..., xϑ # ∈ (N> 0)

0 x 0 x , ...b xϑ (0) = b. ΦM b−θ−θ ...b 0 ϑ

, it holds

Proof Theory and Post-turing Analysis

149

Proof. Since M has only two states 0 and 1, the computation leading to the value ΦM (ϕ) (0) = ϕ (0) = b where 5 := min {n | σn = 1} (see 2.2.2.3 above) ends at the ﬁrst occurrence of a state σ = 0, which is only possible if σ = 1. Hence we can isolate the last computation step 5 executing the order "ϕ (0) , 0# +→ "∆ (ϕ (0) , 0) , Π (ϕ (0) , 0) , 1# and ignore the initial state 0 occurring in all preceding scanning positions and the adjacent orders. Let min {n ≤ 5 | ∆ (ϕn (0) , 0) = 0}, if (∃n ≤ 5) ∆ (ϕn (0) , 0) = 0 , d := 0, otherwise ) e := ∆ (ϕ (0) , 0) and s := ∆ (ϕi (0) , 0); note that d = ∆ (ϕd (0) , 0). In i<

the remainder we argue by cases.

– Suppose d = 0. We let ξ := 0, S := "ϕ (0)# ∈ S0,0 and observe that such "ξ, S# satisﬁes the condition 1. – Suppose d = 1. Note that ∆ (ϕn (0) , 0) ≥ 0 holds for all n < 5. For otherwise, any ∆ (ϕn (0) , 0) = −1, n < 5, would create a cycle preventing the computation to reach step n+1. Hence d = # {n < 5 | ∆ (ϕn (0) , 0) = 0}. We stipulate that one of the required pair "ξ, S# shall satisfy the corresponding condition 1, 2 or 3. ← − − → → • Suppose e < 1. Let − ϕ s := 0 , ϕ (0) , ..., ϕ (s) , 0 . This uniquely determines ξ ≤ ν and S = "b0 , ..., bξ # ∈ S0,ξ for which there is a ξ+1 y → such that − y = "y0 , ..., yξ # ∈ (N> ) ϕ s = by0 ...b ξ . It is readily 0

0

ξ

veriﬁed that such "ξ, S# satisﬁes the condition 1. Namely, the subcondition (a) holds for S and x being the skeleton and the body of ϕ. Note that x coincides with y on every coordinate ι < ξ. The only nontrivial observation is related to subcondition (b) - it reads that any computation step n < 5 with ∆ (ϕn (0) , 0) = 1 can be iterated x times for any x ∈ N> 0 , without changing the ﬁnal value ΦM (ϕ) (0). • Suppose e = 1 and ϕ (s) = b. Since ΦM (ϕ) (0) = b, we have ϕ (s) = ← − − → → ϕ (s + 1) = b. Let − ϕ s+1 := 0 , ϕ (0) , ..., ϕ (s) , ϕ (s + 1) , 0 . Arguing as above, we get ξ ≤ ν and S = "b0 , ..., bξ # = "b0 , ..., b# ∈ S0,ξ and ξ y → y = "y0 , ..., yξ # ∈ (N> ) with yξ > 1, such that − ϕ s+1 = by0 ...b ξ . 0

0

ξ

Having this, it is readily veriﬁed that such "ξ, S# satisﬁes the condition 2 (see analogous passage above). • Suppose e = 1 and ϕ (s) = b. Since ΦM (ϕ) (0) = b, we have → ϕ (s + 1) = b. Deﬁne − ϕ s+1 as above. By the above token, we get 0 < ξ ≤ ν and S = "b0 , ..., bξ−1 , bζ+1 # = "b0 , ..., bξ−1 , b# ∈ S0,ξ and ξ+1 y y → such that − y = "y0 , ..., yξ−1 , yξ # ∈ (N> ) ϕ s+1 = by0 ...b ξ−1 b ξ = 0

0

yξ−1 by00 ...bξ−1 b

ξ−1

ξ

. Moreover, we observe that yξ−1 = 1, since the leftmost y

ξ−1 occurrence of bξ−1 in the string bξ−1 is immediately followed by the ﬁnal occurrence b, while bξ−1 = b. Having this, it is readily veriﬁed that such "ξ, S# satisﬁes the condition 3.

150

L. Gordeew

– Suppose d = −1. This case is symmetric to previous case d = 1. We note that ∆ (ϕn (0) , 0) ≤ 0 holds for all n < 5, and stipulate by the same token that the required pair "ξ, S# shall satisfy the corresponding condition 4, 5 or 6 depending on whether e > −1, e = −1 ∧ ϕ (s) = b or else e = −1 ∧ ϕ (s) = b. Corollary 7. Let !M ! = 2, B ⊆ A0 , µ, ν ∈ N. There is a recursive functional ‫ג‬µ,ν ∈ [Tµ,ν × B Eµ,ν ], Dom (‫ג‬µ,ν ) = {"ϕ, b# ∈ Tµ,ν × B | ΦM (ϕ) (0) = b}, such that for all "ϕ, b# ∈ Dom (‫ג‬µ,ν ), ‫ג‬µ,ν (ϕ, b) = "S, X# ∈ Φ M (0, µ, ν, ""b# , {1}#) and exactly one of the following conditions 1-5 holds. 1. 2. 3. 4. 5.

µ+ν+1

X = (N> 0) µ+ξ > ν−ξ × N> (∃ξ ≤ ν) X = (N> 0) 1 × (N0 ) µ+ξ−1 ν−ξ+1 (∃ξ : 0 < ξ ≤ ν) X = (N> × {1} × (N> 0) 0) µ−ξ > ν+ξ (∃ξ ≤ µ) X = (N> × N> 0) 1 × (N0 ) µ−ξ+1 ν+ξ−1 (∃ξ : 0 < ξ ≤ µ) X = (N> × {1} × (N> 0) 0)

Remark 8. Weakening in the corollary the assumption B ⊆ A0 to B ⊆ A will result in weakening (∃ξ : 0 < ξ ≤ ν) and (∃ξ : 0 < ξ ≤ µ) to (∃ξ : 0 < ξ ≤ ν + 1) and (∃ξ : 0 < ξ ≤ µ + 1) in the conditions 3 and 5, respectively. To put it more exactly, the resulting modiﬁcation yields the two new solutions ‫ג‬µ,ν (ϕ, 0) = µ+ν µ+ν "S, X# for X = (N> × {1} and X = {1} × (N> . The proof is readily ob0) 0) tained by adding the corresponding two new cases in Proposition 5. Now by 5.1.4 (see above), this reﬁnement of the corollary obviously implies the decidability of ΦM (ϕ) ↓, provided that !M ! = 2 (cf. Footnote 2 in 4.1.1 above). Deﬁnition 9. Let !M ! = 2, B = {1, 2} ⊆ A0 , ε ∈ N> 0 and U ⊆

Tµ,ν .

µ,ν≤ε

Furthermore, suppose that ΦM is total, i.e. Dom (ΦM ) = T, and discrete-valued for U in B. Let ‫ ג‬:= ‫ג‬µ,ν , each ‫ג‬µ,ν ∈ [Tµ,ν × B Eµ,ν ] being as in the µ,ν≤ε

corollary. Deﬁne the adjacent canonical ε-covering Ω (2) := Rng (‫ ג‬U ×B ) = {‫ג‬µ,ν (ϕ, b) | µ, ν ≤ ε ∧ ϕ ∈ U ∧ b ∈ B} ⊆

Eµ,ν

µ,ν≤ε

and for any ﬁxed c ∈ N> deﬁne the correlated “trivial” c-partition 0 (2) (2) Ω (2) = ΩS ∪ ΩL by setting, for all µ, ν ≤ ε: (2)

(2)

ΩS ∩ Eµ,ν := ∅ if µ + ν ≥ c, else ΩL ∩ Eµ,ν := ∅. odelnumbers Deﬁnition 10. We say A accepts DNF iﬀ A0 includes (codes/g¨ of ) conjunction ∧ and disjunction ∨ and two special signs and which enable us to interpret positive (negative) literals as strings of (). To put it more precisely, we interpret a propositional variable vi and its negation ¬vi , i ∈ N, by

Proof Theory and Post-turing Analysis

151

, ..., and , ..., , respectively.5 Now any formula ∈ DNF is expressed by the i+1

i+1

(uniquely determined) isomorphic A-tape ϕ ∈ T whose skeleton has the shape of , whose leftmost sign is printed in the cell 0. Moreover, the body of ϕ arises from by dropping parentheses, while expressing conjunction, disjunction and literals according to the above interpretation. For example, the translation of = (v0 ∧ v1 ) ∨ ¬v2 results in ϕ = ∧ 2 ∨ 3 ∈ T0,4 . For any ε ∈ N> 0 , deﬁne the adjacent canonical DNF-segment U := {ϕ | ∈ DNF} ∩ T0,ν . ν≤ε

Conclusion 11 Let !M ! = 2, B = {1, 2} ⊆ A0 , ε ≥ c ∈ N> 1 . Suppose that A accepts DNF, let U ⊆ T0,ν be the adjacent canonical DNF-subsegment. Suppose ν≤ε

that ΦM is total and discrete-valued for U in B. Consider the adjacent canonical (2) (2) E0,ν and the correlated c-partition Ω (2) = ΩS ∪ ΩL . We ε-covering Ω (2) ⊆ ν≤ε

(2)

(2)

(2)

= {Oi = ∅ | i ∈ I}, ΩS = {Os | s ∈ S}, ΩL have Ω S ∪ L = I and S ∩ L = ∅. For a moment suppose that

= {Ol | l ∈ L} where

– ΦM (ϕ) = 2 ⇔ ∈ TAUdnf holds for all ϕ ∈ U . Arguing as in 5.2 (see above), let Oi := k (Oi ), and set X := ϕ ∈ U | ΦM (ϕ) = 2 – Y := ϕ ∈ U | ΦM (ϕ) = 1 We claim that Oi = Os ∪ Ol holds along with: – U= 1. 2. 3. 4. 5.

i∈I

s∈S

l∈L

S∪L=I S∩L=∅ (∀i ∈ I) (Oi ⊆ X ∨ Oi ⊆ Y ) (∀l ∈ L) (Ol ∩ Y = ∅) Os ∪ Y = U

s∈S

To establish this claim, it will suﬃce to verify the last two conditions 4, 5 (cf. (2) 5.2 above). First note that 5 is obvious. For on the one hand ΩS ∩ E0,2 = ∅ (see Deﬁnition 8 above). On the other hand, Y ∩E0,2 = U ∩E0,2 , since ∅ = X ϕ = ∨ ∈ T0,2 for = v0 ∨ ¬v0 ∈ TAUdnf . Consider the remaining condition 4. Take any l ∈ L and Ol = k (Ol ) where Ol = "S, X# ∈ Φ M (0, 0, ν, ""b# , {1}#) for c ≤ ν ≤ ε and b ∈ {1, 2}. Moreover, by Corollary 6, one of the following three conditions holds. 5

As usual in algebra, we drop superﬂuous parentheses, while assuming that conjunction binds stronger than disjunction. This particular interpretaion is not important for the result - one can just as well use a distinguished letter for the atomic negation ¬, instead of .

152

L. Gordeew ν+1

1. X = (N> 0) ξ > > ν−ξ 2. (∃ξ ≤ ν) X = (N> 0 ) × N1 × (N0 ) ξ−1 ν−ξ+1 3. (∃ξ : 0 < ξ ≤ ν) X = (N> × {1} × (N> 0) 0) Suppose ϕ ∈ Ol and consider . By the above conditions, at most one propositional variable occurrence in (the one corresponding to the coordinate ξ in the latter condition) is v0 , other variable occurrences being vι for any ι ∈ N> 1. That is, arbitrary variable-substitutions beyond v0 and v1 for all but at most one variable occurrences in preserve the assumption ϕ ∈ Ol , and hence the value b of ΦM (ϕ ) (0). Assigning pairwise diﬀerent indices to all variable occurrences in it is readily seen, then, that at least one such ϕ ∈ Ol is not a tautology. By the main assumption ΦM (ϕ) = 2 ⇔ ∈ TAUdnf , the latter yields b = 1. Hence Ol ⊆ Y , and in particular Ol ∩ Y = ∅, since Ol = ∅ - which completes the proof of Condition 4. Now Proposition 1 (see Introduction) shows that the main assumption fails. Thus no Turing machine with only two initial states can decide TAUdnf , Q.E.D.

References [B] [H] [P] [T] [Tu]

S. Buss, Bounded arithmetic, Bibliopolis, Napoli (1986) A. Haken, The intractability of resolution, Theor. Comp. Sci. 39 (1985), 297308 E. Post, Finite combinatory processes — formulation I, Journ. Symb. Logic 1 (1936), 103-105 G. Takeuti, Computational complexity and proof theory, Sugaku 39 (2), 1987, 110-123 (Transl. in AMS Sugaku expositions 0 (1), 1988, 1-14) A. Turing, On computable numbers, with an application to the Entscheidungsproblem, Proc. London Math. Soc. 42 (1937), 230-265

Interpolation for Natural Deduction with Generalized Eliminations Ralph Matthes Institut f¨ ur Informatik der Ludwig-Maximilians-Universit¨ at M¨ unchen Oettingenstraße 67, D-80538 M¨ unchen, Germany [email protected]

Abstract. A modiﬁcation of simply-typed λ-calculus by generalized elimination rules in the style of von Plato is presented. Its characteristic feature are permutative conversions also for function types and product types. After the addition of certain extensional reduction rules, an interpolation theorem (` a la Lyndon) is proven which is also aware of the terms (a. k. a. the proofs via the Curry-Howard-isomorphism) like in ˇ Cubri´ c’s treatment of the usual λ-calculus. Connections between interpolation and canonical liftings of positive and negative type dependencies are given which are important for the intensional treatment of inductive datatypes.

1

Introduction

In logic, interpolation is often used as a tool to reduce arguments on monotone operators to those on positive operators. Mostly, one is satisﬁed with a logically equivalent positive formula expressing the original monotone dependency. When it comes to functional programming with datatypes, logical equivalence of datatypes is not very helpful. (Think of all the natural numbers being proofs of ˇ Nat.) Therefore, a more intensional approach is called for. [Cub94] presented interpolation with additional information: Not only an intermediate formula/type is gained but also proofs/terms for the both implications such that their composition reduces to the original given proof/term in some strongly normalizing and conﬂuent calculus. This idea is taken up in a modiﬁcation ΛJ of λ-calculus presented in section 2 which has a diﬀerent application rule than λ-calculus and therefore needs permutative conversions already for function types. Concerning provability/typability, there is no diﬀerence with λ-calculus. However, the normal forms have a more appealing structure, made very precise in the last subsection. Section 3 lists several meta-theoretic properties of ΛJ. The interpolation theorem for ΛJ is stated and proven in great detail in section 4. Many subtleties show that in ΛJ one gets an even deeper insight into interpolation than in λ-calculus. Section 5 starts with some material on η-rules and long normal forms, then introduces lifting of arbitrary type dependencies and calculates the interpolants for all of them. In the last subsection, some thoughts are given on the use of interpolation for the purpose of positivization of monotone type dependencies. R. Kahle, P. Schroeder-Heister, and R. St¨ ark (Eds.): PTCS 2001, LNCS 2183, pp. 153–169, 2001. c Springer-Verlag Berlin Heidelberg 2001

154

R. Matthes

Acknowledgement: Many thanks to my former colleague Thorsten Altenkirch who directed my interest towards intensional aspects of the interpolation theorem, and to Jan von Plato who introduced me to the ﬁeld of generalized eliminations and inspired the present work by his visit to Munich in September 1999. Also thanks to the anonymous referee whose comments were of great help.

2

System ΛJ with Sums and Pairs

We study an extension of simply-typed λ-calculus in the spirit of von Plato [vP98]. The main idea is the use of generalized eliminations, most notably the generalized →-elimination (see below) which is the closure under substitution of the left implication rule of Gentzen, written in the syntax of λ-calculus. For the implicational fragment—called ΛJ—see [JM99]. ΛJ can also be studied in an untyped fashion (hence departing completely from its logical origins): Its conﬂuence and standardization have been established in [JM00]. On the other hand, ΛJ can be assigned intersection types, and thus a characterization of the strongly normalizing terms via typability can be given [Mat00]. 2.1

Types and Terms

Types (depending on an inﬁnite supply of type variables denoted α, β—also with decoration) are deﬁned inductively: (V) (→) (+) (×) (1) (0)

α ρ→σ ρ+σ ρ×σ 1 0

Let FV(ρ) be the set of type variables occurring in ρ (“free variables”). We associate → to the right and abbreviate ρ1 → . . . → ρn → σ by ρ → σ. Typed terms (with types indicated as superscripts or after a colon, and also depending on an inﬁnite supply of variables xρ for any type ρ) are deﬁned inductively: (V) (→-I) (→-E) (+-I) (+-E) (×-I) (×-E) (1-I) (0-E)

xρ : ρ λxρ rσ : ρ → σ rρ→σ (sρ , xσ.tτ ) : τ inj1,ρ rσ : σ + ρ, inj2,ρ rσ : ρ + σ rρ+σ (xρ.sτ , y σ.tτ ) : τ rρ , sσ : ρ × σ rρ×σ (xρ.y σ.tτ ) : τ IN1 : 1 r0 ρ : ρ

Interpolation for Natural Deduction with Generalized Eliminations

155

Note that +-elimination always [Pra65] has been given in the “generalized style” and that ×-elimination is the same as tensor elimination in linear logic1 . The essential new ingredient (by von Plato) is the generalized →-elimination. In λcalculus, we would have (→-E)’ rρ→σ sρ : σ (×-E)’ rρ×σ L : ρ and rρ×σ R : σ Let FV(r) be the set of term variables occurring free in r where x is bound in λxr and in x.t (and also for x and y in x.y.t where x = y is understood). We identify terms which diﬀer only in the names of their bound variables already on the syntactic level. Hence, e. g., x(y, z.z) and x(y, y.y) are the same term, and αconversion is kept out of the system. With this identiﬁcation, it is straightforward to deﬁne the result rρ [xσ := sσ ] of substituting s for x in r (without capture of free variables) as a term of type ρ. In the same way, one can deﬁne simultaneous substitution rρ [xσ , y τ := sσ , tτ ] of x by s and y by t (with x = y) which also gives a term of type ρ. 2.2

Reduction

Rules of β-conversion: (β→ ) (λxρ rσ )(sρ , y σ.tτ ) ✄ t[y := r[x := s]] (β+ ) (inji,ρ3−i rρi )(xρ11.r1τ , xρ22.r2τ ) ✄ ri [xi := r] for i = 1, 2 (β× ) rρ , sσ (xρ.y σ.tτ ) ✄ t[x, y := r, s] Clearly, if r ✄ s then s has the same type as r (“subject reduction”). Since also FV(s) ⊆ FV(r), theses rules are a valid means of transforming proofs (via the Curry-Howard-isomorphism [How80]). In λ-calculus, we would have (β→ )’ (λxρ rσ )sρ ✄ r[x := s] (β× )’ rρ , sσ L ✄ r and rρ , sσ R ✄ s It is well-known for λ-calculus with sums that β-reduction alone does not produce terms with the subformula property (every subterm should have a type which forms a part of the type of the term or any of its free variables). In ΛJ, this already comes from the fragment with function types only, e. g. the term xα→α (y α , z α .λuρ→ρ u)(λv ρ v, wρ→ρ .y) : α with free variables xα→α and y α is βnormal but has a subterm of uncontrolled type ρ. Let an elimination be anything which may occur as an argument in one of the elimination rules of the term system, hence an object (s, z.t), (x.s, y.t), (x.y.t) or a type (for (0-E)). They will be denoted by R, S, . . . (For λ-calculus, terms, objects of the form (x.s, y.t), L, R and types would be eliminations.) FV(S) shall have the obvious meaning as the free variables of S. Deﬁne for any elimination S such that y τ S is a term, the following eliminations: 1

For restrictions to linear terms this is much more useful than the two projections, expressed below by L and R.

156

R. Matthes

(→-E) (s, x.tτ ){S} := (s, x.tS) where we assume that x ∈ / FV(S) (+-E) (x1 .tτ1 , x2 .tτ2 ){S} := (x1 .t1 S, x2 .t2 S) where we assume that x1 , x2 ∈ / FV(S) / FV(S) (×-E) (x1 .x2 .tτ ){S} := (x1 .x2 .tS) where we assume that x1 , x2 ∈ (0-E) τ {S} := σ with σ the type of the term xτ S It is immediate that whenever rRS is a term, then R{S} is an elimination and rR{S} is also a term. Rule schema of permutative conversion: (π) rRS ✄ rR{S} Written out more explicitly, the schema comprises: (π→ ) (π+ ) (π× ) (π0 )

rρ1 →ρ2 (s, x.t)S ✄ r(s, x.tS) rρ1 +ρ2 (x1 .t1 , x2 .t2 )S ✄ r(x1 .t1 S, x2 .t2 S) rρ1 ×ρ2 (x1 .x2 .t)S ✄ r(x1 .x2 .tS) (r0 τ S)σ ✄ rσ

The rule (π+ ) is the usual permutative conversion for sums in natural deduction formulation. We also introduce the following projection rules (to be justiﬁed below): / FV(t) (κ→ ) r(s, x.t) ✄ t for x ∈ / FV(t) (κ× ) r(x.y.t) ✄ t for x, y ∈ Let be the term closure of all of the above conversions and let 0 be that of all the conversions except the projection rules. Both reduction relations satisfy subject reduction since types are obviously preserved under ✄. The set NF of normal forms is deﬁned inductively by: (V) (→-E) (+-E) (×-E) (0-E) (→-I) (+-I) (×-I) (1-I)

x ∈ NF. s, t ∈ NF ∧ y ∈ FV(t) ⇒ x(s, y.t) ∈ NF. t1 , t2 ∈ NF ⇒ x(x1 .t1 , x2 .t2 ) ∈ NF. t ∈ NF ∧ x1 or x2 ∈ FV(t) ⇒ x(x1 .x2 .t) ∈ NF. xτ ∈ NF. r ∈ NF ⇒ λxr ∈ NF. r ∈ NF ⇒ inji r ∈ NF. r1 , r2 ∈ NF ⇒ r1 , r2 ∈ NF. IN1 ∈ NF.

It can easily be checked that NF is the set of terms which are normal with respect to . Note that unlike λ-calculus, we do not need to consider several arguments to a variable (or even worse for sums and products) but only one elimination. Deﬁne the set NF0 by removing the requirements on free variables from the deﬁnition of NF. Again, it is easy to check that NF0 characterizes the normal terms with respect to 0 .

Interpolation for Natural Deduction with Generalized Eliminations

2.3

157

Comparison with λ-Calculus

Clearly, we can embed λ-calculus into our system by setting rs := r(s, z.z) and rL := r(x.y.x) and rR := r(x.y.y) because then (λxr)s = (λxr)(s, z.z) →β→ r[x := s] and r, sL = r, s(x.y.x) →β× r and likewise for r, sR. ΛJ can also be encoded in terms of λ-calculus: r(s, x.t) := t[x := rs] and r(x.y.t) := t[x, y := rL, rR]. This time, only the equalities induced by the rewrite systems are preserved (call =λ that of λ-calculus): (β→ ) (β× ) (π→ ) (π× ) (κ→ ) (κ× )

(λxr)(s, z.t) = t[z := (λxr)s] =λ t[z := r[x := s]] r, s(x.y.t) = t[x, y := r, sL, r, sR] =λ t[x, y := r, s] r(s, x.t)S = t[x := rs]S = (tS)[x := rs] = r(s, x.tS) r(x.y.t)S = t[x, y := rL, rR]S = (tS)[x, y := rL, rR] = r(x.y.tS) r(s, x.t) = t[x := rs] = t if x ∈ / FV(t) r(x.y.t) = t[x, y := rL, rR] = t if x, y ∈ / FV(t)

It is well-known that the set of normal λ-terms w. r. t. (β→ )’, (β+ ), (β× )’, (π+ ) and (π0 )—henceforth the corresponding reduction will be denoted by λ — is inductively characterized by the set NF , deﬁned as follows: (V) (→-E) (+-E) (×-E) (0-E) (→-I) (+-I) (×-I) (1-I)

x ∈ NF . s, t ∈ NF ∧ y ∈ FV(t) ⇒ t[y := xs] ∈ NF . t1 , t2 ∈ NF ⇒ x(x1 .t1 , x2 .t2 ) ∈ NF . t ∈ NF ∧ x1 or x2 ∈ FV(t) ⇒ t[x1 , x2 := xL, xR] ∈ NF . xτ ∈ NF . r ∈ NF ⇒ λxr ∈ NF . r ∈ NF ⇒ inji r ∈ NF . r1 , r2 ∈ NF ⇒ r1 , r2 ∈ NF . IN1 ∈ NF .

Apparently, NF is nothing but the encoded version of NF. But unlike NF , NF’s deﬁnition is syntax-directed and does not come as a surprise. Consequently, an analysis of normal forms in λ-calculus can be done more conveniently via a detour through ΛJ. We will see below that a more ﬁne-grained analysis of interpolation can be achieved in this manner.

3

Strong Normalization, Standardization, and Conﬂuence

We claim strong normalization of . This would be proved by combining the proofs of strong normalization of ΛJ (with function types only) with that of λ-calculus with sums and permutative conversions in [JM99] since we do not expect any harm from products. It should be possible to address standardization in a similar way to [JM00] where untyped ΛJ (without case analysis and pairing) has been treated. We would prefer to give a direct proof of conﬂuence instead of proving local conﬂuence and referring to strong normalization (Newman’s Lemma). We believe that again the method in [JM00] should carry over to the full system. (Local conﬂuence can easily be established by considering the critical pairs which are non-trivial, though.)

158

4

R. Matthes

Interpolation

Intuitionistic logic has the interpolation property which means that from a proof of ρ → σ one can ﬁnd a type τ with type variables among the intersection of those in ρ and σ such that ρ → τ and τ → σ are provable. This would be called Craig interpolation. From the proof, one can see that more can be said about positivity and negativity of the occurrences of the type variables in τ : Positive occurrences in τ imply positive occurrences in both ρ and σ, and similarly for negative occurrences. This is called Lyndon interpolation. We did not yet exploit our λ-calculus structure in which we formulate intuitionistic reasoning. Since there are terms (a. k. a. proofs) of r : ρ → σ, s : ρ → τ and t : τ → σ, we may ask whether one can have s and t even such that r and λxρ .t(sx) are intensionally equal and not merely proofs of the same stateˇ ment. [Cub94] established this fact for usual λ-calculus (and extended the result to bicartesian closed categories). In his case, intensional equality for λ-calculus meant equality w. r. t. β-reduction and permutations. Unfortunately, this does not suﬃce for the treatment of generalized applications. Therefore, we have to extend our notion of reduction by extended permutation rules and then prove ˇ Lyndon interpolation in a style quite similar to [Cub94]. However, we will proﬁt a lot from the simpler structure of normal forms in our calculus. 4.1

Adding Some Extensionality

In order to formulate the interpolation theorem we need a more powerful permutation principle for function and product types. The extended permutation rules are: e (π→ ) g[z := r(s, x.t)] ✄ r(s, x.g[z := t]) for any term g with z ∈ FV(g) and (w. l. o. g.) x ∈ / FV(g) e (π× ) g[z := r(x.y.t)] ✄ r(x.y.g[z := t]) for any term g with z ∈ FV(g) and (w. l. o. g.) x, y ∈ / FV(g)

Clearly, the standard permutation rules are the special case with g := zS. The extended rules are also justiﬁed by our encoding into λ-calculus since in that encoding, we have g[z := r(s, x.t)] = g[z := t[x := rs]] = r(s, x.g[z := t]) and g[z := r(x.y.t)] = g[z := t[x, y := rL, rR]] = r(x.y.g[z := t]). Let e be the reduction relation which is the term closure of the β-rules, e e (π+ ), (π→ ) and (π× ). The (excluded) degenerate cases with z ∈ / FV(g) would read: (κr→ ) g ✄ r(s, x.g) for x ∈ / FV(g) (κr× ) g ✄ r(x.y.g) for x, y ∈ / FV(g) They are simply the reverses of (κ→ ) and (κ× ). Hence, with respect to equality theory, the degenerate cases are already included in .

Interpolation for Natural Deduction with Generalized Eliminations

4.2

159

The Interpolation Theorem

As a notation, for a set Γ of typed variables with types ρ1 , . . . , ρn , write Γ ρ . Then, ⊗ρ := ρ1 × . . . × ρn (associated to the left). The operator ⊗ shall bind stronger than the other connectives. Let +(ρ) be the set of type variables occurring at some (not necessarily strictly) positive position in ρ and likewise let −(ρ) be the set of type variables occurring negatively in ρ. E. g. α, β ∈ +((α → α) → β) and only α ∈ −((α → α) → β). p (for polarity) will be a variable ranging over {+, −}. Hence, α ∈ p(ρ) is a well-deﬁned statement conditional on p’s value. Also write −p to mean − in case p = + and + in case p = −. More formally, we may now deﬁne +(ρ) and −(ρ) as follows: (V) (→) (+) (×) (1) (0)

+(α) := {α}, −(α) := ∅. α ∈ p(ρ → σ) :⇔ α ∈ −p(ρ) ∨ α ∈ p(σ) α ∈ p(ρ + σ) :⇔ α ∈ p(ρ) ∨ α ∈ p(σ) α ∈ p(ρ × σ) :⇔ α ∈ p(ρ) ∨ α ∈ p(σ) α∈ / p(1) α∈ / p(0)

Theorem 1. Let rρ ∈ NF and FV(r) ⊆ Π π Σ σ . Set Πr := FV(r) ∩ Π and Σr := FV(r) ∩ Σ. Then, there is a type ρˆ and terms f ρˆ and λz ρˆg ρ both in NF such that (FV) Πr ⊆ FV(f ) ⊆ Π, Σr ⊆ FV(λzg) ⊆ Σ and (z ∈ FV(g) ⇔ Πr = ∅) and z occurs at most once in g (+−) α ∈ p(ˆ ρ) ⇒ α ∈ p(⊗π) ∩ p(σ → ρ) (for all α and all values of p) (e ) g[z := f ] ∗e r Notation: I(r, Π, Σ) = (ˆ ρ, f, λzg). ( above denotes disjoint union.) Notice that this theorem is a strengthening of interpolation: By assumption, r proves ⊗π → σ → ρ, and a type ρˆ is produced together with proofs of ⊗π → ρˆ and ρˆ → σ → ρ, and every α occurring in ρˆ also occurs in ⊗π and in σ → ρ. The interpolation theorem one would like to work with follows with π := π and σ := ∅. Also note that from our earlier discussion on NF versus NF , we can infer 2 ˇ interpolation for λ-calculus as in [Cub94] . Proof. Firstly, the function I is deﬁned by recursion on r ∈ NF.3 It is always clear that the second and third component are in NF0 , have the right types and that FV(f ) ⊆ Π and FV(λzg) ⊆ Σ, and that z occurs at most once in g . 2 3

We cannot guarantee that z occurs only once in g, and we will deduce g[z := f ] ∗λ r from g[z := f ] =λ r and conﬂuence of λ . We have to be careful with the disjointness assumption for Π and Σ in the recursive calls. Nevertheless, under the renaming convention, we see that in the course of the recursion we never change Π and Σ such that they intersect again.

160

R. Matthes

(triv) Case Πr = ∅. Set I(r, Π, Σ) := (1, IN1, λzr) with a new variable z. All the other cases are under the proviso “otherwise”. (V) Case xρ with x ∈ Π. Set I(x, Π, Σ) := (ρ, x, λxx). Case xρ with x ∈ Σ. This is covered by (triv); I(x, Π, Σ) = (1, IN1, λzx). (→-E) Case xρ1 →ρ2 (sρ1 , y ρ2.tτ ) with x ∈ Π. We already have I(s, Σ, Π) = (ˆ ρ1 , f1 , λz1 g1 ) (note the interchange of Π and Σ) and I(t, Π ∪ {y}, Σ) = (ˆ τ , f2 , λz2 g2 ). Set

I(x(s, y.t), Π, Σ) := (ˆ ρ1 → τˆ, λz1 .x(g1 , y.f2 ), λz.z(f1 , z2 .g2 )).

Case xρ1 →ρ2 (sρ1 , y ρ2.tτ ) with x ∈ Σ. We already have I(s, Π, Σ) = (ˆ ρ1 , f1 , λz1 g1 ) and Set

I(t, Π, Σ ∪ {y}) = (ˆ τ , f2 , λz2 g2 ). I(x(s, y.t), Π, Σ) := (ˆ ρ1 × τˆ, f1 , f2 , λz.z(z1 .z2 .x(g1 , y.g2 ))).

(+-E) Case xρ1 +ρ2 (xρ11.tτ1 , xρ22.tτ2 ) with x ∈ Π. We already have I(ti , Π ∪ {xi }, Σ) = (ˆ τi , fi , λzi gi )

for i = 1, 2.

Set I(x(x1 .t1 , x2 .t2 ), Π, Σ) := (ˆ τ1 + τˆ2 , x(x1 .inj1,ˆτ2 f1 , x2 .inj2,ˆτ1 f2 ), λz.z(z1 .g1 , z2 .g2 )). Case xρ1 +ρ2 (xρ11.tτ1 , xρ22.tτ2 ) with x ∈ Σ. We already have I(ti , Π, Σ ∪ {xi }) = (ˆ τi , fi , λzi gi )

for i = 1, 2.

Set I(x(x1 .t1 , x2 .t2 ), Π, Σ) := (ˆ τ1 × τˆ2 , f1 , f2 , λz.z(z1 .z2 .x(x1 .g1 , x2 .g2 ))). (×-E) Case xρ1 ×ρ2 (xρ11.xρ22.tτ ) with x ∈ Π. We already have I(t, Π ∪ {x1 , x2 }, Σ) = (ˆ τ , f, λzg). Set

I(x(x1 .x2 .t), Π, Σ) := (ˆ τ , x(x1 .x2 .f ), λzg).

Interpolation for Natural Deduction with Generalized Eliminations

161

Case xρ1 ×ρ2 (xρ11.xρ22.tτ ) with x ∈ Σ. We already have τ , f, λzg). I(t, Π, Σ ∪ {x1 , x2 }) = (ˆ Set τ , f, λz.x(x1 .x2 .g)). I(x(x1 .x2 .t), Π, Σ) := (ˆ (0-E) Case x0 τ with x ∈ Π. Set I(xτ, Π, Σ) := (0, x, λx.xτ ). Case x0 τ with x ∈ Σ. (triv) yields I(xτ, Π, Σ) = (1, IN1, λz.xτ ). (→-I) Case λxρ rσ . We already have I(r, Π, Σ ∪ {x}) = (ˆ σ , f, λzg). Set I(λxr, Π, Σ) := (ˆ σ , f, λzλx.g). (+-I) Case inji,ρ rσ . We already have I(r, Π, Σ) = (ˆ σ , f, λzg). Set σ , f, λz.inji,ρ g). I(inji,ρ r, Π, Σ) := (ˆ ρi , fi , λzi gi ) for i = 1, 2. (×-I) Case r1ρ1 , r2ρ2 . We already have I(ri , Π, Σ) = (ˆ Set ρ1 × ρˆ2 , f1 , f2 , λz.z(z1 .z2 .g1 , g2 )). I(r1 , r2 , Π, Σ) := (ˆ (1-I) Case IN1. Covered by (triv), hence I(IN1, Π, Σ) = (1, IN1, λz.IN1). Because of (triv), we trivially have that z ∈ FV(g) implies Πr = ∅. Concerning the polarity requirement (+−) we only deal with an implication elimination xρ1 →ρ2 (sρ1 , y ρ2.tτ ). The other cases do not need any further sophistication. Case x ∈ Π. Let α ∈ p(ˆ ρ1 → τˆ). Therefore, α ∈ −p(ˆ ρ1 ) ∪ p(ˆ τ ). Show that α ∈ p(⊗π) ∩ p(σ → τ ). Case α ∈ −p(ˆ ρ1 ). By induction hypothesis, α ∈ −p(⊗σ) ∩ −p(π → ρ1 ). Therefore, α ∈ p(σ → τ ). Also, α ∈ p(⊗π) ∪ −p(ρ1 ). In case α ∈ −p(ρ1 ), α ∈ p(ρ1 → ρ2 ) ⊆ p(⊗π) because xρ1 →ρ2 ∈ Π. Case α ∈ p(ˆ τ ). By induction hypothesis, α ∈ p(⊗π × ρ2 ) ∩ p(σ → τ ). Hence, α ∈ p(⊗π) ∪ p(ρ2 ). If α ∈ p(ρ2 ), then α ∈ p(ρ1 → ρ2 ) ⊆ p(⊗π) again since xρ1 →ρ2 ∈ Π. ρ1 ) ∪ p(ˆ τ ). Show that α ∈ Case x ∈ Σ. Let α ∈ p(ˆ ρ1 × τˆ). Therefore, α ∈ p(ˆ p(⊗π) ∩ p(σ → τ ). Case α ∈ p(ˆ ρ1 ). By induction hypothesis, α ∈ p(⊗π) ∩ p(σ → ρ1 ). Hence, α ∈ p(σ → τ ) ∪ p(ρ1 ). In case α ∈ p(ρ1 ), α ∈ −p(ρ1 → ρ2 ) ⊆ p(σ → τ ) because xρ1 →ρ2 ∈ Σ. Case α ∈ p(ˆ τ ). By induction hypothesis, α ∈ p(⊗π) ∩ p(σ → ρ2 → τ ). Hence, α ∈ p(σ → τ ) ∪ −p(ρ2 ). If α ∈ −p(ρ2 ), then α ∈ −p(ρ1 → ρ2 ) ⊆ p(σ → τ ) again since xρ1 →ρ2 ∈ Σ.

162

R. Matthes

The veriﬁcation of the statements that f and g have certain free variables, hinges on the tacit assumption in the deﬁnition that names of the bound variables are always chosen appropriately (which can be done by the renaming convention). First show that if z ∈ / FV(g), then Πr = ∅: Only the cases (triv), (×-E), (→-I) and (+-I) have to be analyzed. The most interesting case is (×-E)Π: x ∈ Π. Therefore, we have to show that z ∈ FV(g). This holds by induction hypothesis, since due to x(x1 .x2 .t) ∈ NF, x1 or x2 in FV(t). The other cases follow directly from the induction hypothesis. Therefore, we have proved Πr = ∅ ⇒ z ∈ FV(g)

(∗)

Now prove Πr ⊆ FV(f ) and Σr ⊆ FV(λzg) together with f, λzg ∈ NF: (Again we only deal with (→-E) because no further arguments are needed for the other cases.) Case x ∈ Π. Πx(s,y.t) = {x} ∪ Πs ∪ (Πt \ {y}). Σx(s,y.t) = Σs ∪ (Σt \ {y}). y ∈ FV(t) (by deﬁnition of NF), hence (Π ∪ {y})t = Πt ∪ {y}. By induction hypothesis, Σs ⊆ FV(f1 ), Πs ⊆ FV(λz1 g1 ), Πt ∪ {y} ⊆ FV(f2 ) and Σt ⊆ FV(λz2 g2 ). Therefore, Πx(s,y.t) ⊆ FV(λz1 .x(g1 , y.f2 )), y ∈ FV(f2 ) and Σx(s,y.t) ⊆ FV(λz.z(f1 , z2 .g2 )). Finally, by (∗), z2 ∈ FV(g2 ). Case x ∈ Σ. Πx(s,y.t) = Πs ∪ (Πt \ {y}). Σx(s,y.t) = {x} ∪ Σs ∪ (Σt \ {y}). y ∈ FV(t) (by deﬁnition of NF), hence (Σ ∪ {y})t = Σt ∪ {y}. We (implicitly) assume that y ∈ / Π, hence Πt \ {y} = Πt . By induction hypothesis, Πs ⊆ FV(f1 ), Σs ⊆ FV(λz1 g1 ), Πt ⊆ FV(f2 ) and Σt ∪ {y} ⊆ FV(λz2 g2 ). Therefore, Πx(s,y.t) ⊆ FV(f1 , f2 ), Σx(s,y.t) ⊆ FV(λz.z(z1 .z2 .x(g1 , y.g2 )) and y ∈ FV(g2 ). Because Πx(s,y.t) = ∅, Πs = ∅ or Πt = ∅. In the ﬁrst case, z1 ∈ FV(g1 ) by (∗), in the second case z2 ∈ FV(g2 ) by (∗). Hence, by induction hypothesis (and z2 = y), z(z1 .z2 .x(g1 , y.g2 )) ∈ NF. Finally, we check (e ). Only the reduction is given. The induction hypothesis is not explicitly mentioned. The subcases are simply indicated by Π and Σ. (triv) r = r. (V) Π: x = x. (→-E) Π: (λz1 .x(g1 , y.f2 ))(f1 , z2 .g2 ) β→ g2 [z2 := x(g1 [z1 := f1 ], y.f2 )] ∗e e g2 [z2 := x(s, y.f2 )] π→ x(s, y.g2 [z2 := f2 ]) ∗e x(s, y.t). Note that due to (Π ∪ {y})t = ∅ (by the requirement y ∈ FV(t) in the deﬁnition of NF), we e have z2 ∈ FV(g2 ) which allows to apply (π→ ). Σ: f1 , f2 (z1 .z2 .x(g1 , y.g2 )) β× x(g1 [z1 := f1 ], y.g2 [z2 := f2 ]) ∗e x(s, y.t) (+-E) Π: x(x1 .inj1,ˆτ2 f1 , x2 .inj2,ˆτ1 f2 )(z1 .g1 , z2 .g2 ) π+ x(x1 .(inj1,ˆτ2 f1 )(z1 .g1 , z2 .g2 ), x2 .(inj2,ˆτ1 f2 )(z1 .g1 , z2 .g2 )) β+ β+ x(x1 .g1 [z1 := f1 ], x2 .g2 [z2 := f2 ]) ∗e x(x1 .t1 , x2 .t2 ) Σ: f1 , f2 (z1 .z2 .x(x1 .g1 , x2 .g2 )) β× x(x1 .g1 [z1 := f1 ], g2 [z2 := f2 ]) ∗e x(x1 .t1 , x2 .t2 ) ∗ e x(x1 .x2 .g[z := f ]) (×-E) Π: g[z := x(x1 .x2 .f )] π× e x(x1 .x2 .t): Because of (Π ∪ {x1 , x2 })t = ∅ (by the requirement x1 or x2 ∈ FV(t) in the deﬁnition e of NF), we have z ∈ FV(g) which allows to apply (π× ). Σ: x(x1 .x2 .g[z := f ]) ∗e x(x1 .x2 .t)

Interpolation for Natural Deduction with Generalized Eliminations

(0-E) Π: xτ = xτ . (→-I) λx.g[z := f ] ∗e λxr. (+-I) inji,ρ g[z := f ] ∗e inji,ρ r. (×-I) f1 , f2 (z1 .z2 .g1 , g2 ) β× g1 [z1 := f1 ], g2 [z2 := f2 ] ∗e r1 , r2

163

Note that I(r, Π, Σ) does not depend on variables which are not free in r, i. e. I(r, Π, Σ) = I(r, Πr , Σr ). (However, the case of (→-I) requires the more general deﬁnition.) For the applications we slightly improve the deﬁnition of I to a function I which only diﬀers in the treatment of the case (→-E): In case x ∈ Π and s is a variable x1 ∈ Π, we now set: I (x(x1 , y.t), Π, Σ) := (ˆ τ , x(x1 , y.f2 ), λz2 g2 ). The justiﬁcation of the properties (FV), (+−) and (e ) is obvious due to I(x1 , Σ, Π) = (1, IN1, λz1 x1 ) and hence I(x(x1 , y.t), Π, Σ) = (1 → τˆ, λz1 .x(x1 , y.f2 ), λz.z(IN1, z2 .g2 )). In case x ∈ Σ and t is the variable y, we set: I (x(s, y.y), Π, Σ) := (ˆ ρ1 , f1 , λz1 .x(g1 , y.y)). Again, it is easy to verify (FV), (+−) and (e ) by exploiting I(y, Π, Σ ∪ {y}) = (1, IN1, λz2 y) and consequently I(x(s, y.y), Π, Σ) = (ˆ ρ1 × 1, f1 , IN1, λz.z(z1 .z2 .x(g1 , y.y)). Let us illustrate that extended permutation rules were indeed needed. Example 1. Set r := xρ→σ (uρ , y σ .λv τ y σ ). By (V), I(u, {u}, {x}) = (ρ, u, λuu) and I(y, {x, y}, {u, v}) = (σ, y, λyy). By (→-I), I(λvy, {x, y}, {u}) = (σ, y, λyλvy). Hence I(r, {x}, {u}) = (ρ → σ, λu.x(u, y.y), λz.z(u, y.λvy)). But we only have (z(u, y.λvy))[z := λu.x(u, y.y)] β→ (λvy)[y := x(u, y.y)] = λv.x(u, y.y) and cannot reach r by help of ∗ .

5

Some Uses of the Interpolation Algorithm

In the ﬁrst subsection, additional concepts are given in preparation for the statements on the interpolation of liftings.

164

5.1

R. Matthes

Long Normal Forms and Eta-Reduction

Deﬁne the set LNF of long normal forms by keeping all the rules of the deﬁnition of NF (with NF replaced by LNF) except (V) which now reads (V) If x : α or x : 0 or x : 1, then x ∈ LNF. Lemma 1. The interpolation functions I and I preserve long normal forms, i. e., for rρ ∈ LNF, I(r, Π, Σ) = (ˆ ρ, f, λzg) fulﬁlls f, λzg ∈ LNF, and similarly for I . Proof. Immediate by induction on r ∈ LNF.

Consider the following conversions: / FV(r) (η→ ) λxρ .rρ→σ (x, y σ.y) ✄ r, if x ∈ (η+ ) rρ+σ (xρ.inj1,σ x, y σ.inj2,ρ y) ✄ r (η× ) rρ×σ (xρ.y σ.x, y) ✄ r Let η be the term closure of those three rules. The η-rules for λ-calculus would have the following diﬀerences: / FV(r) (η→ )’ λxρ .rρ→σ x ✄ r, if x ∈ (η× )’ rL, rR ✄ r Clearly, the above η-rules of ΛJ are justiﬁable in our encoding of ΛJ into λ-calculus since, in that encoding, λx.r(x, y.y) = λx.rx and r(x.y.x, y) = rL, rR. Deﬁne η-expansion η(xρ ) ∈ LNF for variables by recursion on ρ as follows: (triv) (→) (+) (×)

If ρ is a type variable or ρ ∈ {0, 1}, then η(x) := x. η(xρ→σ ) := λy ρ .x(η(y), z σ .η(z)). η(xρ+σ ) := x(y ρ .inj1,σ η(y), z σ .inj2,ρ η(z)). η(xρ×σ ) := x(y ρ .z σ .η(y), η(z)).

Notice that λ-calculus does not allow such an easy η-expansion of variables. 5.2

Lifting of Positive and Negative Type Dependencies

It is well-known that if a type variable α occurs only positively in some type ρ, one can “lift” terms of type σ → τ to terms of type ρ[α := σ] → ρ[α := τ ] (see e. g. [Lei90]). We pursue a new approach which does not use any positivity requirement for the deﬁnition (but will give the usual deﬁnition in case it is met). But ﬁrst, we have to introduce type substitution: ρ[α := σ] shall denote the result of replacing every occurrence of α in ρ by σ. Similarly, deﬁne the result ρ[α, β := σ, τ ] of simultaneous substitution of α by σ and β by τ in ρ (we assume α = β). Type substitution and simultaneous type substitution may also be carried out for terms, denoted by r[α := σ] and r[α, β := σ, τ ], respectively.

Interpolation for Natural Deduction with Generalized Eliminations

165

Associate with every type variable α a “fresh” type variable α− . Let αp be α for p = + and let α−p be α− for p = + and α for p = −. Set likewise for term variables h and h− , hp := h for p = + and h−p := h− for p = + and h−p := h for p = −. Deﬁne for every type ρ and every type variable α a term liftpλαρ of type ρ with free variables among the typed variables h : α−p → αp , h− : αp → α−p and x : ρ[α := α− ] by recursion on ρ (write r[α ↔ α− ] for r[α, α− := α− , α]): (triv) If ρ is a type variable = α or ρ ∈ {0, 1}, set liftpλαρ := x (which is type-correct!) (V) liftpλαα := hp (x, y α.y). (Note that hp : α− → α.) (→) liftpλα.ρ1 →ρ2 := −

−

− ρ2 [α:=α ] .liftpλαρ2 ). λxρ1.x(ρ1 →ρ2 )[α:=α ] (lift−p λαρ1 [α ↔ α ], x − −p Note that lift−p → αp , λαρ1 [α ↔ α ] has free variables among h : α − p −p ρ1 h : α → α and x . (+) liftpλα.ρ1 +ρ2 := −

−

−

x(ρ1 +ρ2 )[α:=α ] (xρ1 [α:=α ].inj1,ρ2 liftpλαρ1 , xρ2 [α:=α ].inj2,ρ1 liftpλαρ2 ).

(×) liftpλα.ρ1 ×ρ2 :=

−

−

−

x(ρ1 ×ρ2 )[α:=α ] (xρ1 [α:=α ].xρ2 [α:=α ].liftpλαρ1 , liftpλαρ2 ). It should be clear that x with diﬀerently written types means diﬀerent variables (even if ρ1 and ρ2 happen to be the same type!). Lemma 2. (i) liftpλαρ ∈ LNF and xρ[α:=α ] ∈ FV(liftpλαρ ). (ii) α ∈ p(ρ) ⇔ h ∈ FV(liftpλαρ ) and α ∈ −p(ρ) ⇔ h− ∈ FV(liftpλαρ ). −

Proof. By induction on ρ.

By a slight extension of our notation with a variable q ranging over {+, −}, we may rewrite (ii) to α ∈ qp(ρ) ⇔ hq ∈ FV(liftpλαρ ). For applications, we normally do not want that h− occurs in liftpλαρ . Therefore, we deﬁne the set Only+ (ρ) of type variables occurring only positively in ρ and the set Only− (ρ) of type variables occurring only negatively in ρ by setting α ∈ Onlyp (ρ) :⇔ α ∈ / −p(ρ). It is clear that we get the following recursive (with respect to ρ) characterization of Only+ (ρ) and Only− (ρ): (V) (→) (+) (×) (1) (0)

Only+ (α) = all variables, Only− (α) = all variables except α. Onlyp (ρ → σ) = Only−p (ρ) ∩ Onlyp (σ). Onlyp (ρ + σ) = Onlyp (ρ) ∩ Onlyp (σ). Onlyp (ρ × σ) = Onlyp (ρ) ∩ Onlyp (σ). Onlyp (1) = all variables. Onlyp (0) = all variables.

/ FV(liftpλαρ ). Corollary 1. If α ∈ Onlyp (ρ), then h− ∈ Lemma 3. If α ∈ / FV(ρ), then liftpλαρ = η(x). Proof. Induction on ρ.

166

5.3

R. Matthes

Interpolation and Lifting

Lemma 4. (i) I (liftpλαρ , {h, h− , x}, ∅) = (ρ, liftpλαρ , λz.η(z)). (ii) I (liftpλαρ , {x}, {h, h− }) = (ρ[α := α− ], η(x), λx.liftpλαρ ). Proof. By induction on ρ. Note that we never use the case (triv) of the interpolation theorem. The case (V) needs the modiﬁcations made for I . Only (→) (i) will be dealt with: By induction hypothesis (i) and (ii) −

I (liftpλαρ2 , {h, h− , xρ2 [α:=α ] }, ∅) = (ρ2 , liftpλαρ2 , λz2 .η(z2 )) ρ1 [α:=α ] I (lift−p }, {hα λαρ1 , {x −

p

→α−p

−p

, hα −

→αp

and

}) =

−

−

(ρ1 [α := α− ], η(xρ1 [α:=α ] ), λxρ1 [α:=α ].lift−p λαρ1 ). − ρ1 α Therefore, I (lift−p λαρ1 [α ↔ α ], {x }, {h

−p

→αp

p

, hα −

→α−p

}) =

− (ρ1 , η(xρ1 ), λxρ1.lift−p λαρ1 [α ↔ α ]).

Finally (recall that we may drop superﬂuous variables from Π and Σ), I (liftpλα.ρ1 →ρ2 , {h, h− , x(ρ1 →ρ2 )[α:=α ] }, ∅) = −

(ρ1 → ρ2 , liftpλα.ρ1 →ρ2 , λzλxρ1.z(η(xρ1 ), z2 .η(z2 ))). +

For a ﬁxed type variable α we now deﬁne ρ which is ρ with every negative occurrence of α replaced by α− (recall that α− shall be a “fresh” type variable) and ρ− which is ρ+ [α ↔ α− ]. Then α ∈ Onlyp (ρp ) and α− ∈ Only−p (ρp ), in short: αq ∈ Onlyqp (ρp ). More formally, we deﬁne ρp for ﬁxed α: (triv) (V) (→) (+) (×)

If ρ is a type variable = α or ρ ∈ {0, 1}, then set ρp := ρ. αp is deﬁned as before. (ρ → σ)p := ρ−p → σ p . (ρ + σ)p := ρp + σ p . (ρ × σ)p := ρp × σ p .

It is clear that FV(ρp ) ⊆ FV(ρ)∪{α− }, that ρ−p = ρp [α ↔ α− ], ρp [α− := α] = ρ and αq ∈ Onlyqp (ρp ). [Concerning the last statement, consider its equivalent / −qp(ρp ). (V): If p = q, then αp ∈ / −(αp ). If p = q, then α−p ∈ / +(αp ). (→): αq ∈ q −p p −p Show α ∈ / −qp(ρ → σ ), i. e., α ∈ / −q(−p)(ρ ) and α ∈ / −qp(σ p ) which both follow from the induction hypothesis.] Lemma 5. Let x : ρ[α := α− ], h : α−p → αp , h− : αp → α−p (hence hq : ˆ be a “fresh” type variable. α−qp → αqp , and therefore hp : α− → α) and let α Then I (liftpλαρ , {x, hq }, {h−q }) = qp

(ρqp , liftpλα.ρqp [α− :=α] α := α− ], λxρ .liftpλα.ρ−qp [α− :=α] α := α]). ˆ [ˆ ˆ [ˆ

Interpolation for Natural Deduction with Generalized Eliminations

167

Proof. Induction on ρ (quite tedious).

The preceding two lemmas may be written down in a uniform notation as follows: I (liftpλαρ , {x} ∪ Π, Σ) = ∗

α := α− ], λxρ .liftpλα.ρ∗ [α:=α][α α := α]) (ρ∗ , liftpλα.ρ∗ [α− :=α] ˆ [ˆ ˆ − :=α] [ˆ  ρ , if h, h− ∈ Π    − ρ[α := α ] , if h, h− ∈ Σ with ρ∗ := p , if h ∈ Π, h− ∈ Σ ρ    −p ρ , if h− ∈ Π, h ∈ Σ 5.4

Application: Positivization of Monotone Types

Consider a type ρ and a type variable α such that there is a term m : ρ with free variables among h : α− → α and x : ρ[α := α− ]. We know that if α ∈ Only+ (ρ), then lift+ λαρ is such a term. By lemma 4, interpolation (the function I ) gives back the type ρ and that term together with an η-expansion of the identity. What do we get for arbitrary m ∈ NF? We get ρ, f ρˆ, λz ρˆg ρ ) I (m, {h, x}, ∅) = (ˆ with f, λzg ∈ NF, FV(f ) ⊆ {h, x}, FV(λzg) = ∅, FV(ˆ ρ) ⊆ FV(ρ) (especially, / FV(ˆ ρ)), α ∈ Only+ (ˆ ρ) and g[z := f ] ∗e m. A proof for the last but one α− ∈ property: If α were in −(ˆ ρ), then α ∈ −((α− → α) × ρ[α := α− ]) which is not true. Moreover, λxρ .f [α− := α][hα→α := λy α y] is a closed term of type ρ → ρˆ. Therefore, we found for λαρ and m a positivization: A type ρˆ with α ∈ Only+ (ρ) such that there are closed terms of types ρˆ → ρ and ρ → ρˆ. We even have that g[z := f [α− := α][hα→α := λy α y]] = g[z := f ][α− := α][hα→α := λy α y] ∗e m[α− := α][hα→α := λy α y]. Therefore, if m[α− := α][hα→α := λy α y] ∗e x holds, we have even a retract from ρˆ to ρ. But this cannot be expected without adding the η-conversions: It is easy to see that := λy α y, λy α y] ∗η x. liftpλαρ [α− := α][hα→α , hα→α − Therefore, we could hope for a retract with respect to e ∪ η . But this seems to hold only in the trivial case of α ∈ Only+ (ρ) where we do not need any positivization. I conjecture that something like −

ρ[α:=α ˆ lift+ λαρˆ[x

]

−

:= f [α := α− ][hα

→α−

−

:= λy α y]] ∗e f

holds. In the case of α ∈ Only+ (ρ), it can easily be shown by Lemma 4 (without the help of η-reduction): In fact one has to show (for arbitrary ρ and α):

168

R. Matthes

Lemma 6. Two easy properties of liftings: − − − − − − →α− (i) liftpλαρ [xρ[α:=α ] := liftpλαρ [α := α− ][hα →α , hα := λy α y, λy α y] ∗e − p liftλαρ . (ii) liftpλαρ [α− := α][hα→α , hα→α := λy α y, λy α y][xρ := liftpλαρ ] ∗e liftpλαρ . − e ) is Proof. Routine veriﬁcation by simultaneous induction on ρ. (Note that (π× not needed beyond (π× ).)

Let us ﬁnally study an interesting example of positivization. Example 2. Let ρ := (((α → β) → α) → α) → α. Set − (α− →β)→α− α α mρ := λy ((α→β)→α)→α .y λz α→β .x λz1 .z1 S, uα 4 .h(u4 , u5 .u5 ) , u6 .u6 with

−

−

β α S := (λz2α .h(z2 , uα 1 .z(u1 , u2 .u2 )), u3 .u3 )

and the only free variables h : α− → α and x : ρ[α := α− ]. It is an easy exercise to calculate I (r, {x, h}, ∅) = ((α → β) → α, . . .). The shown type may be seen as the optimal positivization. Thorsten Altenkirch found another one, namely (((α → β) → α) → β) → α, which can also be found by using a more complicated term m. Since we are not dealing with uniform interpolation [Pit92], the interpolating types may depend on the given monotonicity proof m.

6

Conclusions

In the light of the deﬁnitional embedding of the system ΛJ with generalized eliminations into usual λ-calculus, e. g. via r(s, z.t) → t[z := rs], we arrived at a more ﬁne-grained analysis of Lyndon interpolation even when taking into account the proofs/terms and not only provability/typability. Moreover, the proof of the results on the system with generalized eliminations shows how elegant reasoning becomes by induction on the normal forms obtainable in the system in contrast to those in the standard formulation of λ-calculus resp. derivations in intuitionistic logic. Finally, a new formulation of liftings has been presented whose behaviour under interpolation could have hardly been studied in standard λ-calculus due to notational burdens already in the deﬁnition of the result of interpolation. The following questions certainly have to be addressed in the future: What is the behaviour of the extended permutation rules and of η-reduction? Is it possible to operationalize η-expansion and prove the usual theorems about it? Is it possible to prove strong normalization of our system by continuation-passingstyle transformations in the spirit of [dG99]? Is there a nice categorical semantics ˇ of ΛJ which would allow to infer our theorem from the general result in [Cub94]? And, of course, the conjecture on the previous page should be settled since it would allow to reduce iteration and primitive recursion on monotone inductive types to those on positive inductive types without recourse to impredicativity (compare [Mat01]).

Interpolation for Natural Deduction with Generalized Eliminations

169

References ˇ ˇ [Cub94] Djordje Cubri´ c. Interpolation property for bicartesian closed categories. Archive for Mathematical Logic, 33:291–319, 1994. [dG99] Philippe de Groote. On the strong normalisation of natural deduction with permutation-conversions. In Paliath Narendran and Micha¨el Rusinowitch, editors, Rewriting Techniques and Applications, 10th International Conference (RTA ’99), Trento, Italy, July 2-4, 1999, Proceedings, volume 1631 of Lecture Notes in Computer Science, pages 45–59. Springer Verlag, 1999. [How80] W. A. Howard. The formulae-as-types notion of construction. In J. P. Seldin and J. R. Hindley, editors, To H. B. Curry: Essays on Combinatory Logic, Lambda Calculus and Formalism, pages 479–490. Academic Press, 1980. [JM99] Felix Joachimski and Ralph Matthes. Short proofs of normalization for the simply-typed lambda-calculus, permutative conversions and G¨ odel’s T. Archive for Mathematical Logic, 1999. Accepted for publication. [JM00] Felix Joachimski and Ralph Matthes. Standardization and conﬂuence for a lambda calculus with generalized applications. In Leo Bachmair, editor, Rewriting Techniques and Applications, Proceedings of the 11th International Conference RTA 2000, Norwich, UK, volume 1833 of Lecture Notes in Computer Science, pages 141–155. Springer Verlag, 2000. [Lei90] Daniel Leivant. Contracting proofs to programs. In Piergiorgio Odifreddi, editor, Logic and Computer Science, volume 31 of APIC Studies in Data Processing, pages 279–327. Academic Press, 1990. [Mat00] Ralph Matthes. Characterizing strongly normalizing terms for a lambda calculus with generalized applications via intersection types. In Jos´e D. P. Rolim, Andrei Z. Broder, Andrea Corradini, Roberto Gorrieri, Reiko Heckel, Juraj Hromkovic, Ugo Vaccaro, and Joe B. Wells, editors, ICALP Workshops 2000, Proceedings of the Satellite Workshops of the 27th International Colloquium on Automata, Languages, and Programming, Geneva, Switzerland, volume 8 of Proceedings in Informatics, pages 339–353. Carleton Scientiﬁc, 2000. [Mat01] Ralph Matthes. Tarski’s ﬁxed-point theorem and lambda calculi with monotone inductive types. To appear in Synthese, 2001. [Pit92] Andrew Pitts. On an interpretation of second order quantiﬁcation in ﬁrst order intuitionistic propositional logic. The Journal of Symbolic Logic, 57(1):33–52, 1992. [Pra65] Dag Prawitz. Natural Deduction. A Proof-Theoretical Study. Almquist and Wiksell, 1965. [vP98] Jan von Plato. Natural deduction with general elimination rules. Submitted, 1998.

Implicit Characterizations of Pspace Isabel Oitavem Universidade Nova de Lisboa & CMAF — Universidade de Lisboa Av. Prof. Gama Pinto, 2 1649-003 Lisboa Portugal Tel. +351-21-7904903, Fax: +351-21-7954288 [email protected]

Abstract. In this paper we focus on the class of functions computable in deterministic polynomial space — Pspace. Our aim is to give a survey on implicit characterizations of Pspace. Special attention will be given to characterizations where no bounded recursion scheme is invoked and within them to term rewriting characterizations. Keywords: computational complexity, implicit characterizations, term rewriting, Pspace.

1

Introduction

Several machine independent approaches to relevant classes of computational complexity have been developed. All them lead to characterizations of classes of computational complexity where the machine formulation and resources are implicit — implicit characterizations. Conceptually, implicit characterizations link computational complexity to levels of deﬁnitional and inferential abstractions of signiﬁcant independent interest. In this paper we give a survey on implicit characterizations of the class of functions computable in deterministic polynomial space — Pspace. Our aim is to describe and to discuss implicit characterizations of Pspace with diﬀerent skills. Namely bounded, input-sorted, term rewriting and unsorted characterizations of Pspace. These characterizations, with minor variations, can be found in [15], [16] and [17]. Usually the presence of bounds in the recursion schemes is seen as a negative feature of the characterizations, mainly due to two order of reasons: The presence of bounds often cause diﬃculties when handling with the classes; Moreover the bounds address, more or less explicitly, to the computational constraints of the characterized classes. With the input-sorted characterizations we solve, if not both, at least the second of these problems. The reason to consider input sorts

The author would like to thank to CMAF and Funda¸c˜ ao para a Ciˆencia e a Tecnologia.

R. Kahle, P. Schroeder-Heister, and R. St¨ ark (Eds.): PTCS 2001, LNCS 2183, pp. 170–190, 2001. c Springer-Verlag Berlin Heidelberg 2001

Implicit Characterizations of Pspace

171

lays on the recursion schemes. Let us consider f deﬁned by primitive recursion as follows: f (, x ¯) = g(¯ x) and f (z , x ¯) = h(z, x ¯, f (z, x ¯)). Notice that f occurs in ¯) uses previous both sides of the last equality. Actually, the deﬁnition of f (z , x values f (·, x ¯), which are inputted in the last position of h — critical input. By other words, one uses values f (·, x ¯) before having the object (function) f formed. Therefore, one may have a full knowledge about the objects occurring in a given input, or not. This distinction leads to input-sorted characterizations. It is also possible to consider unsorted systems of function terms and to use purely syntactic measures to control the “impredicativity” of the terms. This approach leads to unsorted characterizations. Whenever an implicit characterization is established, we are dragging a class of computational complexity to a “less computational” context. In that “less computational” context, we often have a characterization of a class of functions and not any longer a characterization of computational processes. In other words, it might happen that the function deﬁnitions of the implicit characterization yield algorithms which does not respect the constraints (time and/or space) of the characterized class of complexity. The term rewriting approach allows us to characterize implicitly classes of computational complexity without dismiss the underlined computational processes. That is achieved by using the rewriting rules to express the appropriate computation strategies. That is for instance the case of [1], where Beckmann and Weiermann describe a term rewriting system for Ptime — the class of functions computable in deterministic polynomial time. The additional problem that we face when approaching Pspace is the presence of the (unbounded) primitive recursion scheme. It is easy to understand that the usual formulation of the safe primitive recursion scheme leads us to a term rewriting system where, in the derivations, the length of the terms is not necessarily bounded polynomially by the length of the ﬁrst term. Notice that the obvious term rewriting rules corresponding to the safe primitive recursion scheme are something of the form P REC[g, h](, x ¯; y¯) → g(¯ x; y¯) P REC[g, h](z , x ¯; y¯) → h(z, x ¯; y¯, P REC[g, h](z, x ¯; y¯)), where z denotes the numeric successor of z. This yields the derivation P REC[g, h](z , x ¯; y¯) → ··· → h(z, x ¯; y¯, h(·, x ¯; y¯, h(·, x ¯; y¯, h(· · · (h(, x ¯; y¯, g(¯ x; y¯))) · · ·)))), where the symbol h occurs z times in the last term. Thus the length of the last term grows exponentially on the length of the ﬁrst term. Therefore, in this context, a suitable reformulation of the safe primitive recursion scheme is imperative.

172

2

I. Oitavem

Pspace - An Overview

Within the most studied classes of computational complexity are P and NP — the class of languages decidable in deterministic, respectively non-deterministic, polynomial time. Actually, the question whether P coincides with NP is often pointed as one of the main problems in computational complexity. These two classes, P and NP, are the ﬁrst two levels of the polynomial hierarchy of time, p PH. One usually deﬁnes Σ0p = P, Σi+1 = NP(Σip ) and PH = ∪i∈IN Σip , where p NP(Σi ) denotes the class of languages decidable in non-deterministic polynomial p time with oracle in Σip . It is obvious that Σip ⊆ Σi+1 for all i ∈ IN, but it is still open whether some of these inclusions are proper. By other words, it is unknown whether the polynomial hierarchy of time collapses to some level. The description of complete problems for each one of these classes may lead to a better understanding of these classes. Let us consider, for each i ≥ 1, the QSATi problem (quantiﬁed satisﬁability with i alternations of quantiﬁers) described in [18] pp.227-228: Given a boolean expression φ, with boolean variables partitioned into i sets X1 , · · · , Xi , is it true that for all partial truth assignments for variables in X1 there is a partial truth assignment for variables in X2 such that for all partial truth assignments for the variables in X3 , and so on up to Xi , φ is satisﬁed by the overall truth assignment? We represent an instance of QSATi as follows (by slightly abusing our ﬁrst order quantiﬁers): ∃X1 ∀X2 ∃X3 · · · QXi φ where the quantiﬁer Q is ∃ if i is odd and ∀ if i is even. It is known that, for all i ≥ 1, QSATi is Σip -complete. Now, let us consider the problem QSAT (also called QBF , for quantiﬁed boolean formula) deﬁned like QSATi but without any previously deﬁned limitation of the quantiﬁer alternations. Informally speaking QSAT = ∪i QSATi . Since QSATi is a Σip -complete problem and PH = ∪i Σip , one could expect QSAT to be a PH -complete problem. However, this is an open problem. In fact, what we know is that QSAT is a complete problem for Pspace — the class of languages decidable in deterministic polynomial space. In this sense Pspace is the most natural class containing the polynomial hierarchy of time. It is open whether PH coincides with Pspace or not. Nevertheless, a positive answer would entail the collapse of the polynomial hierarchy of time to some ﬁnite level. For more details see [18]. The question of the power of non-determinism in space is much less dramatic than the same problem in the time domain. For instance, as a consequence of Savich’s theorem (1970), we have the collapsing of the polynomial hierarchy of space. Thus, when we restrict ourselves to polynomial space it is irrelevant whether we consider deterministic or non-deterministic computations. Therefore Pspace, deﬁned above as the class of languages decidable in deterministic polynomial space, can also be described as the class of languages decidable in non-deterministic polynomial space. Pspace can also be characterized using parallel computations. It is know that Pspace coincides with the class of languages decidable in alternating polynomial time — see, for instance, [18].

Implicit Characterizations of Pspace

173

In the sequel Pspace denotes, not only the class of languages (boolean functions) decidable in polynomial space but, the class of all functions (over {0, 1}∗ ) computable in polynomial space.

3 3.1

Implicit Characterizations of Pspace Notation

We work with functions deﬁned in cartesian products of {0, 1}∗ and assuming values in {0, 1}∗ , where {0, 1}∗ is the set of 0-1 words. Thus we will have in mind the binary tree and all standard notation related with it: |x| for the length of the sequence/word x, for the sequence of length zero, xy for the concatenation of the sequence x with the sequence y, the “product” x × y = x . . . x (similar in growth to Samuel Buss’ smash function, see [7]) for the concatenation of x with itself |y| times, and x for the sequence that follows immediately after x when we consider the binary tree ordered according to length and, within the same length, x if |x| ≤ |y| for the truncature of x lexicographically. Finally, x|y = z if z ⊆ x ∧ |z| = |y| to y, where z ⊆ x abbreviates ∃y zy = x. 3.2

Bounded Characterization

It is known that Ptime (the class of functions computable in deterministic polynomial time) is the smallest class of functions containing the source, binary successor, projection and conditional functions, and that it is closed under the composition and bounded recursion on notation schemes (see [9] or [10]). It is also known that if we close Ptime under bounded primitive recursion we will get Pspace. This is the case because the number of steps that a Pspace machine may carry is exponential on the length of the input. Thus, ﬁxed the binary notation, we have that Pspace is the smallest class of functions containing the initial functions 1-4 and that is closed under the composition, bounded recursion on notation and bounded primitive recursion: 1) 2) 3) 4)

Si (x) = xi , i ∈ {0, 1} Πjn (x1 , . . . , xn ) = xj , 1 ≤ j ≤ n C(, y, z0 , z1 ) = y, C(xi, y, z0 , z1 ) = zi , i ∈ {0, 1}

¯ x)) Composition: f (¯ x) = g(h(¯ Bounded primitive recursion (exhaustive): f (, x ¯) = g(¯ x) f (y , x ¯) = h(y, x ¯, f (y, x ¯))|t(y,¯x) Bounded recursion on notation (over the branches): f (, x ¯) = g(¯ x) ¯, f (y, x ¯))|t(y,¯x) , i ∈ {0, 1} f (yi, x ¯) = hi (y, x

(source) (binary successors) (projections) (conditional)

174

I. Oitavem

where t is a bounding function, i.e., is a function of the smallest class of functions containing the projection functions and the concatenation and binary product functions and which is closed under composition and assignment of values to variables. 3.3

Two-Input-Sorted Characterization

In 1995, following techniques introduced by Bellantoni and Cook in [4] we established an two-input-sorted characterization of Pspace where no bounded scheme is invoked, see [14] or [15]. As usually, we use a semi-colon to separate diﬀerent sorts of inputs. We consider two sorts of inputs — normal and safe — and we write them by this order. The mentioned characterization, which is here denoted by 2-Pspace, uses sorted versions of the composition and recursion schemes, but it also requires the introduction of some additional initial functions. We say that 2-Pspace is the smallest class of functions containing the initial functions 1-8 and which is closed under the safe composition, the safe primitive recursion and the safe recursion on notation schemes: 1) 2) Si (x; ) = xi, i ∈ {0, 1} 3) Πjn;m (x1 , . . . , xn ; xn+1 , . . . , xn+m ) = xj , 1≤j ≤n+m 4) B(x, ; z) = x, B(x, yi; ) = x1, B(x, yi; zj) = B(xj, y; z), i, j ∈ {0, 1} 5) P (; ) = , P (; xi) = x, i ∈ {0, 1} 6) p(; ) = , p(; x ) = x 7) C(; , y, z0 , z1 ) = y, C(; xi, y, z0 , z1 ) = zi , i ∈ {0, 1} ˆ x; ) = , ×(yi, ˆ ˆ x; ), x; x), 8) ×(, x; ) = B(×(y, i ∈ {0, 1}

(source) (binary successors) (projections) (B-transition) (binary predecessor) (numeric predecessor) (conditional) (modiﬁed (binary) product)

Safe composition: f (¯ x; y¯) = g(¯ r(¯ x; ); s¯(¯ x; y¯)) Safe primitive recursion: Safe recursion on notation:

f (, x ¯; y¯) = g(¯ x; y¯) ¯; y¯) = h(z, x ¯; y¯, f (z, x ¯; y¯)) f (z , x f (, x ¯; y¯) = g(¯ x; y¯) ¯; y¯, f (z, x ¯; y¯)), i ∈ {0, 1} f (zi, x ¯; y¯) = hi (z, x

In the safe composition scheme the absence of some of the functions r¯, s¯ is allowed. This class 2-Pspace characterizes Pspace in the sense that: f (¯ x; ) ∈ 2-Pspace ⇔ f (¯ x) ∈ Pspace, or equivalently, by dismissing the input sorts of the functions in 2-Pspace one gets exactly the Pspace functions.

Implicit Characterizations of Pspace

175

This characterization of Pspace is the analogue of the characterization of Ptime given by Bellantoni and Cook, see [4], [2] or [3]. In this vein the formulation of the safe composition, safe primitive recursion and safe recursion on notation schemes is quite natural. The asymmetry of safe composition scheme allows us “to move” variables from safe positions to normal positions, but not the opposite. In other words, whenever f (¯ x; y¯) ∈ 2-Pspace, the safe composition scheme allows us to deﬁne F (¯ x, y¯; ) = f (¯ x; y¯), but not F (; x ¯, y¯) = f (¯ x; y¯). Regarding the recursion schemes, we have the expected separations between the positions occupied by the recursion variable and by the values obtained recursively. The most delicate part is then to ﬁx a set of functions to start with. In the formulation of the initial functions there are two crucial steps. Firstly, one should notice that we must have the binary successor functions, but we cannot have them over safe inputs. In other words, we must have Si (x; ) = xi, but we cannot allow the functions Si (; x) = xi, i ∈ {0, 1}, to be in our class. In fact, any function which increases the length of a safe input by one unit, together with the safe primitive recursion scheme, leads us out of Pspace. For instance, if S1 (; x) = x1 was in our class then the function f (; ) = 1 and f (x ; ) = S1 (; f (x; )) would be there as well. Such function f has exponential growth and so it is obviously not in Pspace. Secondly, it turns out that to have just Si (x; ) is not enough — see proof of lemma 3.1 in [15]. In fact we cannot have Si (; x), but we need to have some “interesting” function involving safe inputs. This “interesting” function could, for instance, be the normal-bounded safe-binary-successor: xi if |x| < |z| , i ∈ {0, 1}. Although, here we consider the function Si (z; x) = x otherwise B described above. B enables us to carry bits from safe positions into normal positions. However, the number of bits that can be carried is dominated by the length of some normal input. Actually, B(x, y; z) = xˆ(z −1 1)|y , where ˆ stands for concatenation, z −1 is the sequence z written by the reverse order, and w|y denotes the ﬁrst |y| bits of w. Finally, we would like to emphasize that we included the modiﬁed product function among the initial functions, but we could had chosen the usual binary product function instead. Notice that the modiﬁed ˆ x; ) leads to x−1ˆ· · ·ˆx−1 , |y|-times, and the usual binary product product ×(y, leads to xˆ· · ·ˆx, |y|-times. What really matters is to have a function behaving like the product function, i.e. verifying |×(y, x; )| = |x|·|y|. The modiﬁed product is a function satisfying this property and having an easy formulation in present context. One of the main properties of the class 2-Pspace is expressed in the following bounding lemma: Lemma 1. If f ∈ 2-Pspace then there exists a polynomial qf such that (∗) ∀¯ x, y¯ |f (¯ x; y¯)| ≤ max{qf (|¯ x|) , max |yi |}. i

Proof. The proof is by induction on the complexity of the function deﬁnitions. The initial functions pose no problems.

176

I. Oitavem

If f is deﬁned by the safe composition scheme, then we have qg , q¯r , q¯s satisfying (∗) and, therefore, we may take, x|)) + qsi (|¯ x|). qf (|¯ x|) = qg (qr (|¯ i

x|) = If f is deﬁned by safe primitive recursion then, considering qf (|z|, |¯ qh (|z|, |¯ x|) + qg (|¯ x|), the result follows by induction on the recursion variable, ¯; y¯)| ≤ max{qf (||, |¯ x|), maxi |yi |} and, since qg , qh verify (∗). We have |f (, x since |f (u, x ¯; y¯)| ≤ max{qf (|u|, |¯ x|), maxi |yi |}, we get, |f (u , x ¯; y¯)| = |h(u, x ¯; y¯, f (u, x ¯; y¯))| ≤ max{qh (|u|, |¯ x|), max{max |yi |, |f (u, x ¯; y¯)|}} i

x|), max{max |yi |, qh (|u|, |¯ x|) + qg (|¯ x|)}} ≤ max{qh (|u|, |¯ i

x|) + qg (|¯ x|), max |yi |} ≤ max{qh (|u|, |¯ i

≤ max{qh (|u |, |¯ x|) + qg (|¯ x|), max |yi |} ≤ max{qf (|u |, |¯ x|), max |yi |}

i

i

If f is deﬁned by safe recursion on notation then, if we set qh ≡ qh0 + qh1 and qf (|z|, |¯ x|) = qh (|z|, |¯ x|) + qg (|¯ x|), we may carry on the result by induction on the length of the recursion variable, since qg , qh0 , qh1 satisfy (∗). Thus, |f (, x ¯; y¯)| = |g(¯ x; y¯)| ≤ max{qg (|¯ x|), max |yi |} i

x|), max |yi |} = max{qf (||, |¯ i

x|), maxi |yi |}, we get Now, since |f (u, x ¯; y¯)| ≤ max{qf (|u|, |¯ |f (ui, x ¯; y¯)| = |hi (u, x ¯; y¯, f (u, x ¯; y¯))| ≤ max{qh (|u|, |¯ x|), max{maxi |yi |, |f (u, x ¯; y¯)|}} x|), max{maxi |yi |, max{qf (|u|, |¯ x|), maxi |yi |}}} ≤ max{qh (|u|, |¯ = max{qh (|u|, |¯ x|), max{qf (|u|, |¯ x|), maxi |yi |}} = max{qh (|u|, |¯ x|), max{qh (|u|, |¯ x|) + qg (|¯ x|), maxi |yi |}} x|) + qg (|¯ x|), maxi |yi |} ≤ max{qh (|u|, |¯ ≤ max{qh (|ui|, |¯ x|) + qg (|¯ x|), maxi |yi |} x|), maxi |yi |} ≤ max{qf (|ui|, |¯ Therefore, ∀¯ x, y¯ |f (¯ x; y¯)| ≤ max{qf (|¯ x|), maxi |yi |}. The bound that we have just established does not hold for the characterization of Ptime given by Bellantoni and Cook in [4] — PtimeBC . Actually, in PtimeBC , we just have that: If f ∈ PtimeBC then there exists a polynomial qf such that ∀¯ x, y¯ |f (¯ x; y¯)| ≤ qf (|¯ x|) + max |yi |. i

Implicit Characterizations of Pspace

177

Whenever the goal is just to dominate the length of the outputs polynomially on the length of the inputs, it is obviously irrelevant which one of these bounds holds. Nevertheless, for the term rewriting approach it is going to be crucial to have this more accurate bound in 2-Pspace — see the proof of theorem 1, in the term rewriting section. 3.4

Three-Input-Sorted Characterization

In the previous section one described a characterization of Pspace without bounded recursion schemes. However, one might object to the inclusion of the modiﬁed product (or product) function among the initial functions of 2-Pspace. One might prefer to have only initial functions of linear growth. As observed before we must be very careful about operations involving safe positions because — having safe primitive recursion involving safe positions — if they increase the safe input lengths even just one bit, we would get functions of exponential growth, which lie outside Pspace. Therefore, in order to remove the modiﬁed product from the initial functions we seem to have to introduce an intermediate input position, say semi-safe, and use it to construct the modiﬁed product. Thus, if we start with simpler initial functions we will arrive at a more elaborate characterization. Let us give a glance over this alternative characterization of Pspace. Here, there are three kinds of input positions in the functions: normal, semi-safe and safe. We write the normal, semi-safe and safe inputs by this order and separate them by semicolons. We say that 3-Pspace is the smallest class of functions containing the following initial functions 1-7 and which is closed under the safe composition, the safe primitive recursion and the double recursion on notation schemes: 1) (source) 2) Si (; x; ) = xi, i ∈ {0, 1} (binary successors) 3) Πjn;m;l (x1 , . . . , xn ; xn+1 , . . . , xn+m ; xn+m+1 , . . . , xn+m+l ) = xj , 1≤j ≤n+m+l (projections) 4) B(x, ; ; z) = x, B(x, yi; ; ) = x1, B(x, yi; ; zj) = B(xj, y; ; z), i, j ∈ {0, 1} (B-transition) 5) P (; ; ) = , P (; ; xi) = x, i ∈ {0, 1} (binary predecessor) (numeric predecessor) 6) p(; ; ) = , p(; ; x ) = x 7) C(; ; , y, z0 , z1 ) = y, C(; ; xi, y, z0 , z1 ) = zi , i ∈ {0, 1} (conditional) Safe composition: f (¯ x; y¯; z¯) = g(¯ s(¯ x; ; ); r¯(¯ x; y¯; ); t¯(¯ x; y¯; z¯)) Safe primitive recursion: f (, x ¯; y¯; z¯) = g(¯ x; y¯; z¯) ¯; y¯; z¯) = h(w, x ¯; y¯; z¯, f (w, x ¯; y¯; z¯)) f (w , x Double recursion on notation: f (, x ¯; y¯; z¯) = g(¯ x; y¯; z¯) ¯; y¯, f (w, x ¯; y¯; ¯); z¯, f (w, x ¯; y¯; z¯)), i ∈ {0, 1} f (wi, x ¯; y¯; z¯) = hi (w, x

178

I. Oitavem

The goal of the double recursion on notation scheme is to join two schemes in one. However, it could be replaced by the two following schemes: Semi-safe recursion on notation: f (, x ¯; y¯; ) = g(¯ x; y¯; ) f (wi, x ¯; y¯; ) = hi (w, x ¯; y¯, f (w, x ¯; y¯; ); ), i ∈ {0, 1} Safe recursion on notation: f (, x ¯; y¯; z¯) = g(¯ x; y¯; z¯) f (wi, x ¯; y¯; z¯) = hi (w, x ¯; y¯; z¯, f (w, x ¯; y¯; z¯)), i ∈ {0, 1} Here the bounding lemma has the following formulation: Lemma 2. If f ∈ 3-Pspace then there exists a polynomial qf such that ∀¯ x, y¯, z¯ |f (¯ x; y¯; z¯)| ≤ max{qf (|¯ x|) + max |yi | , max |zi |}. i

i

For details see [14]. The three-input-sorted characterization of Pspace described here will be invoked later on. Actually, it is crucial to establish the unsorted characterization of Pspace given in section 3.6. 3.5

Term Rewriting Characterization

The characterization of Pspace presented here can be found in [17] and it is a minor variation of the characterization given in [16]. Our starting point is the two-input-sorted characterization of Pspace described above. An appropriate variation of this characterization yields naturally a class, P S, of function symbols. Among these symbols, we distinguish three — one source and two (binary) constructors — which are used to deﬁne the numerals. We introduce a set of rewriting rules in such a way that terms with no variables are numerals or can be rewritten as such. Henceforth, our main goal is to bound polynomially the length of the terms that can occur in the rewriting chains. The crucial steps are the reformulation of the two-input-sorted characterization of Pspace given above and the reasoning we carry out in order to keep the length of terms occurring in the rewriting chains polynomially bounded. Pspace For the present purposes it is convenient to consider another alternative characterization of Pspace, P s. It results from 2-Pspace by joining the numeric successor function, s(x; ) = x , and the functions E k;l (x1 , · · · , xk ; xk+1 , · · · , xk+l ) = , k ≥ 0 and l ≥ 0 to the initial functions. Notice that E 0;0 designates the source function . Moreover, we consider the following generalization of the recursion schemes: – f (, b, m; ¯ n ¯ , a) = a f (mi, b, m; ¯ n ¯ , a) = f (m, bi, m; ¯ n ¯ , hi (b, m; ¯ n ¯ , a)), i ∈ {0, 1}

Implicit Characterizations of Pspace

179

– f (, b, m; ¯ n ¯ , a) = a f (m , b, m; ¯ n ¯ , a) = f (m, b , m; ¯ n ¯ , h(b, m; ¯ n ¯ , a)) Notice that by initializing these schemes with m being the recursion input (written by the reverse order in case of the generalized safe recursion on notation scheme), b = and a = g(m; ¯ n ¯ ) one obtains the functions deﬁned by safe recursion on notation and the safe recursion schemes. The goal of these schemes is to reverse the usual order of the recursion process. That enables us to avoid nested occurrences of the recursion function during the computation. For instance, if f is deﬁned by safe recursion on notation, f (01; ) leads to f (01; ) → h1 (0; f (0; )) → h1 (0; h0 (; f (; ))) → h1 (0; h0 (; g)). If f is deﬁned by generalized safe recursion on notation one may have f (10, ; g) → f (1, 0; h0 (; g)) → f (, 01; h1 (0; h0 (; g))) → h1 (0; h0 (; g)), but one may also have f (10, ; g) → f (1, 0; h0 (; g)) → · · · → f (1, 0; a1 ) → f (, 01; h1 (0; a1 )) → · · · → f (, 01; a2 ) → a2 , where h0 (; g) = a1 and h1 (0; a1 ) = a2 . This last chain results from giving to the third component of f the highest rewriting priority and it avoids nested occurrences of hi . In conformity with this let us describe the class P s of the number-theoretic functions computable in polynomial space. Deﬁnition 1. P s is the smallest class of number-theoretic functions containing: ˆ and Si , i ∈ {0, 1}; B; E k;l ; Πjk;l , 1 ≤ j ≤ k + l; P ; p; s; C; × ¯ ¯ ∈ P s; SU B[f, g¯, h], if f, g¯, h P RECN [h0 , h1 ], if h0 , h1 ∈ P s; P REC[h], if h ∈ P s, ¯ denotes the unique number-theoretic function which maps where SU B[f, g¯, h] ¯ m; (m, ¯ n ¯ ) to f (¯ g (m; ¯ ); h( ¯ n ¯ )) while P RECN [h0 , h1 ] and P REC[h] denote the unique number-theoretic functions, f and g respectively, deﬁned as follows: f (, b, m; ¯ n ¯ , a) = a f (mi, b, m; ¯ n ¯ , a) = f (m, bi, m; ¯ n ¯ , hi (b, m; ¯ n ¯ , a)), i ∈ {0, 1} g(, b, m; ¯ n ¯ , a) = a g(m , b, m; ¯ n ¯ , a) = g(m, b , m; ¯ n ¯ , h(b, m; ¯ n ¯ , a)) In [16] we prove that P s = 2-Pspace. This equality together with lemma 1 leads to the following bound: Corollary 1. If f ∈ P s then there exists a polynomial qf such that x|), max |yi |}. ∀¯ x, y¯ |f (¯ x; y¯)| ≤ max{qf (|¯ i

We associate to the class of number-theoretic functions, P s, a class of function symbols. Deﬁnition 2. P S is the class of function symbols deﬁned as follows: Si ∈ P S, for any i ∈ {0, 1}; B ∈ P S; E k;l ∈ P S, for k ≥ 0 and l ≥ 0;

180

I. Oitavem

Πjk;l ∈ P S, for any 1 ≤ j ≤ k + l; P ∈ P S; p ∈ P S; s ∈ P S; C ∈ P S; ˆ ∈ P S and × ¯ ∈ P S, ¯ ∈ P S; SU B[f, g¯, h] if f, g¯, h P RECN [h0 , h1 ] ∈ P S, if h0 , h1 ∈ P S; P REC[h] ∈ P S, if h ∈ P S. Notice that the standard interpretation of the function symbols Si , B, E k;l , Πjk;l , ¯ h0 , ¯ P RECN [h0 , h1 ], and P REC[h] (where f, g¯, h, ˆ SU B[f, g¯, h], P , p, s, C, ×, h1 , h ∈ P S are function symbols) is the number-theoretic functions Si , B, ¯ P RECN [h0 , h1 ], and P REC[h] (where ˆ SU B[f, g¯, h], E k;l , Πjk;l , P , p, s, C, ×, ¯ f, g¯, h, h0 , h1 , h ∈ P s are the correspondent number-theoretic functions), respectively. This correspondence from P S (class of function symbols) into P s (class of number-theoretic functions) is denoted by π. Our notation does not make any distinction between elements of P s and elements of P S. For instance π(P ) = P , where the ﬁrst P belongs to P S and the second one belongs to P s. However, it will always be clear, from the context, whether we are dealing with numbertheoretic functions or with function symbols. We deﬁne inductively the length of the function symbols: Deﬁnition 3. For f ∗ ∈ P S we deﬁne the length of f ∗ , lh(f ∗ ), as follows: ˆ 1. lh(f ∗ ) = 1 if f ∗ is Si ,B, E k;l , Πjk;l , P , p, s, C or ×; ∗ ∗ ¯ ¯ 2. If f = SU B[f, g¯, h],for some function symbols f, g¯, h ∈ P S, then lh(f ) = lh(f ) + i lh(gi ) + i lh(hi ) + 1; 3. If f ∗ = P RECN [h0 , h1 ], for some function symbols h0 , h1 ∈ P S, then lh(f ∗ ) = lh(h0 ) + lh(h1 ) + 1; 4. If f ∗ = P REC[h], for some function symbol h ∈ P S, then lh(f ∗ ) = lh(h)+1. Characterizing Pspace Every sequence in {0, 1}∗ can be built up from the empty sequence by successive concatenations with the bits 0 and 1. Since that Si (n; ) represents the concatenation of the sequence n with the sequence i, i ∈ {0, 1}, we deﬁne for every sequence n a numeral n as follows: :≡ E 0;0 and Si (n; ) :≡ Si (n; ), i ∈ {0, 1}. For simplicity of notation, we usually write instead of E 0;0 . Let X be a countable inﬁnite set of variables, disjoint from P S, we deﬁne the set of (ﬁrst-order) terms over P S, T (P S), as the smallest set containing X which satisﬁes the following closure property: if f ∈ P S and r¯, s¯ ∈ T (P S) then f (¯ r; s¯) ∈ T (P S), where r¯, s¯ are tuples of appropriate arity. We say that t ∈ T (P S) is a ground term if no element of X occurs in t, and we denote the set of all ground terms by G(P S). Observe that all the numerals are ground terms and every ground term, t ∈ G(P S), has the shape f (¯ r; s¯) for some f ∈ P S and r¯, s¯ ∈ G(P S) (for t = , f is E 0;0 and no r¯, s¯ occurs). We deﬁne r; s¯) in the lengthof a ground term f (¯ G(P S), lh(f (¯ r; s¯)), as being lh(f ) + i lh(ri ) + i lh(si ). Extending π over G(P S) according to the equation π(f (¯ r; s¯)) = π(f )(π(¯ r); π(¯ s)), where f ∈ P S

Implicit Characterizations of Pspace

181

and r¯, s¯ ∈ G(P S), one has π(n) = n for any numeral n. It is straightforward to prove that: Lemma 3. For all numeral n, lh(n) = |π(n)| + 1. Moreover, one has the following statement which is just a reformulation of corollary 1: Lemma 4. For all f ∈ P S there exists a polynomial qf with natural coeﬃcients r)|), maxi |π(si )|}. such that ∀¯ r, s¯ ∈ G(P S) |π(f (¯ r; s¯))| ≤ max{qf (|π(¯ Considering in IN and {0, 1}∗ the usual less than or equal relations, both denoted by ≤, let β : {0, 1}∗ → IN be the bijection that respects these relations. Deﬁnition 4. Let R be the following set of term rewriting rules: 1. 2. 3. 4. 5. 6. 7. 8. 9. 10. 11. 12. 13. 14. 15. 16. 17. 18. 19. 20. 21. 22.

B(x, ; z) → x B(x, Si (y; ); ) → S1 (x; ), i ∈ {0, 1} B(x, Si (y; ); Sj (z; )) → B(Sj (x; ), y; z), i, j ∈ {0, 1} E k;l (x1 , · · · , xk ; xk+1 , · · · , xk+l ) → Πjk;l (x1 , · · · , xk ; xk+1 , · · · , xk+l ) → xj , 1 ≤ j ≤ k + l P (; ) → P (; Si (x; )) → x, i ∈ {0, 1} p(; ) → p(; S0 (; )) → p(; S0 (Si (x; ); )) → S1 (p(; Si (x; )); ), i ∈ {0, 1} p(; S1 (x; )) → S0 (x; ) s(; ) → S0 (; ) s(S0 (x; ); ) → S1 (x; ) s(S1 (x; ); ) → S0 (s(x; ); ) C(; , y, z, w) → y C(; S0 (x; ), y, z, w) → z C(; S1 (x; ), y, z, w) → w ˆ ×(x, ; ) → ˆ ˆ y; ), x; x), i ∈ {0, 1} ×(x, Si (y; ); ) → B(×(x, ¯ x; y¯) → f (¯ ¯ x; y¯)) SU B[f, g¯, h](¯ g (¯ x; ); h(¯ ¯; y¯, a) → a P RECN [h1 , h2 ](, b, x P RECN [h1 , h2 ](Si (z; ), b, x ¯; y¯, a) → ¯; y¯, hi (b, x ¯; y¯, a)), i ∈ {0, 1} P RECN [h1 , h2 ](z, Si (b; ), x 23. P REC[h](, b, x ¯; y¯, a) → a 24. P REC[h](Si (m; ), b, x ¯; y¯, a) → ¯; y¯, h(b, x ¯; y¯, a)), i ∈ {0, 1} P REC[h](p(; Si (m; )), s(b; ), x Thus, for each function symbol in P S \ {E 0;0 , S0 , S1 } one has in R very simple rewriting rules. The term rewriting system RP S is terminating and conﬂuent on ground terms — see [17] or [16] for a proof.

182

I. Oitavem

Here we are going to focus on proving that for all f ∈ P S there exists a polynomial, pf , such that, for all numerals m, ¯ n ¯ , pf (lh(f (m; ¯ n ¯ ))) is an upper ¯ ) → · · ·. bound for the length of any term occurring in any chain f (m; ¯ n Notice that underlined inputs denote numerals. Therefore, the rules 21 up to 24 can be applied only if certain components were previously rewritten as numerals. This restricts the possible reduction strategies. For instance, requiring the second component of P REC[h](·, ·, ·; ·, ·) to be rewritten as numerals before applying rule 24, we avoid the chain P REC[h](m, b, ·; ·, ·) → · · · → P REC[h](, s(s(· · · (s(b; ); ) · · · ; ), ·; ·, ·). Since that the length of s(s(· · · (s(b; ); ) · · · ; ) grows exponentially on the length of the ﬁrst term, such a reduction strategy would make our goal impossible to achieve. Let us start establishing some useful lemmas. Lemma 5. The rewriting rules 8-14 have the shape t1 → t2 with lh(t2 ) ≤ lh(t1 ), for any assignment of ground terms to variables. This lemma follows directly from the observation of the mentioned rewriting rules. Lemma 6. Every chain t1 → t2 → · · · with t1 = p(; m), for some numeral m, terminates and its last term, let us say t∗ , is a numeral satisfying lh(t∗ ) ≤ lh(m). Proof. The proof follows by induction on lh(m). lh(m) = 1 implies that m = and so the only possible chain respecting the rewriting system rules is p(; ) → . Therefore, the required condition is trivially veriﬁed. Given k ∈ IN, let us assume that the result is valid for any numeral m such that lh(m) = k. Any numeral with length k + 1 has the shape Si (n; ), where i ∈ {0, 1} and n is a numeral with length k. If i = 1 or n = the statement is immediate; Otherwise one has p(; S0 (n; )) → S1 (p(; n); ) → · · · → S1 (p(; n); ) = t∗ , where p(; n) denotes the numeral associated with the sequence represented by π(p)(; n). By induction hypothesis, it follows that t∗ is a numeral satisfying lh(t∗ ) = lh(S1 ) + lh(p(; n)) ≤ lh(S1 ) + lh(n) = lh(S0 (n; )). Lemma 7. ∀k ≤ β(π(m)) lh(s(k) (b; )) ≤ lh(b) + lh(m), for any numerals b, m, where s(0) (b; ) = b, s(1) (b; ) = s(b; ) and s(k+1) (b; ) = s(s(k) (b; ); ). Proof. This lemma is a trivial consequence of the following four facts, which can be easily proved. 1. 2. 3. 4.

π(m) ≥ π(n) ⇒ π(s(β(π(m))) (b; )) ≥ π(s(β(π(n))) (b; )); π(m) ≥ π(n) ⇒ lh(m) ≥ lh(n); lh(s(β(π(m))) (b; )) ≤ lh(B(b, m; m)); lh(B(b, m; m)) ≤ lh(b) + lh(m).

Implicit Characterizations of Pspace

183

Theorem 1. Given f ∈ P S there exists a polynomial pf , with natural coeﬃcients, such that, for any t1 = f (m; ¯ n ¯ ) where m, ¯ n ¯ are numerals, all chains of ground terms t1 → t2 → · · · → tn (n ∈ IN) satisfy lh(ti ) ≤ pf (lh(t1 )) for all 2 ≤ i ≤ n. Proof. The proof is by induction on the complexity of f . The interesting cases occur when f is P RECN [h0 , h1 ] or P REC[h] for some h0 , h1 , h ∈ P S. We are going to prove only the last case. The other one follows the same reasoning. Let us assume that t1 = P REC[h](t11 , t12 , t13 ; t14 , t15 ), where t11 = Si (m; ) for some numeral m, i equal to 0 or 1, and t12 , t13 , t14 , t15 are numerals (the case where t13 and t14 are tuples of numerals is similar). By induction assumption, there exists a polynomial ph such that, given any chain of ground terms h(m; ¯ n ¯ ) → th2 → · · · → thnh where m, ¯ n ¯ are numerals, one has for all 2 ≤ k ≤ nh lh(thk ) ≤ ph (lh(h(m; ¯ n ¯ ))). Since that any chain beginning with t1 is contained in some chain of the shape P REC[h](t11 , t12 , t13 ; t14 , t15 ) → · · · → P REC[h](tl1 , tl2 , tl3 ; tl4 , tl5 ) → tl5 for some l ∈ IN, let us prove that for all n, 1 ≤ n ≤ l, one has: 1. lh(tn1 ) ≤ lh(t11 ) + 1; 2. lh(tn2 ) ≤ lh(t11 ) + lh(t12 ) + 1; 3. lh(tn5 ) ≤ ph (lh(h) + lh(t11 ) + lh(t12 ) + 1 + lh(t13 ) + qh (lh(t11 ) + lh(t12 ) + lh(t13 )) + 2 · lh(t14 ) + lh(t15 )). Notice that in the most diﬃcult case, which results from rule 24, one has that P REC[h](Si (m; ), · · ·) →24 P REC[h](p(; Si (m; )), · · ·) → · · · → P REC[h] (p(; Si (m; ), · · ·) →24 · · ·, m = and i ∈ {0, 1}. In the ﬁrst step the length of the term is increased by one unit. Since then and before any new appliance of rule 24, by lemma 5, the length is not any more increased. Lemma 6 enables us to conclude that lh(p(; Si (m; ))) ≤ lh(Si (m; )) which put us in a good position to keep using this procedure. Therefore, lh(tn1 ) ≤ lh(t11 ) + 1. A similar reasoning, involving lemmas 5 and 7, would lead us to the second assertion. In order to prove the last assertion let us focus on the last component of the terms of the following chain: P REC[h](t11 , t12 , t13 ; t14 , t15 ) →24 P REC[h](t21 , t22 , t13 ; t14 , h(t12 , t13 ; t14 , t15 )) → ··· → P REC[h](t21 , t22 , t13 ; t14 , h(t12 , t13 ; t14 , t15 )) →24 P REC[h](t31 , t32 , t13 ; t14 , h(t22 , t13 ; t14 , h(t12 , t13 ; t14 , t15 ))) → ··· → P REC[h](t31 , t32 , t13 ; t14 , h(t22 , t13 ; t14 , h(t12 , t13 ; t14 , t15 ))) →24 ···.

184

I. Oitavem

The last component of the terms above has the shape h(tj2 , t13 ; t14 , a), for some numeral a, or it derives from h(tj2 , t13 ; t14 , a) by the RP S rewriting rules. Therefore, using the inequality 2) already established and the induction hypothesis, it is easy to argue that lh(tn5 ) ≤ ph (lh(h) + lh(t11 ) + lh(t12 ) + 1 + lh(t13 ) + lh(t14 )+“bound for lh(a)”). To calculate a bound for lh(a) one should notice that: 1) a is t15 or it has the shape h tj2 , t13 ; t14 , h(tj−1 2 , t13 ; t14 , · · · h(t12 , t13 ; t14 , t15 ) · · ·) ; ···

2) By lemma 3, for all numeral n, lh(n) = |π(n)| + 1; 3) By lemma 4, there exists a polynomial qh such that for all r1 , r2 , s1 and s2 in G(P S) one has |π(h(r1 , r2 ; s1 , s2 ))| ≤ max{qh (|π(r1 )|, |π(r2 )|), |π(s1 )|, |π(s2 )|}. Thus, for all r11 , · · · , r1k , r21 , · · · , r2k , s11 , · · · , s1k , s2 one has |π(h(r11 , r21 ; s11 , h(r12 , r22 ; s12 , · · · h(r1k , r2k ; s1k , s2 ) · · ·)))| ≤ max{ max qh (|π(r1i )|, |π(r2i )|), max |π(s1i )|, |π(s2 )|}. 1≤i≤k

1≤i≤k

From this it is simple to show that lh(a) ≤ qh (lh(t11 ) + lh(t12 ) + lh(t13 )) + lh(t14 ) + lh(t15 ). Therefore, we conclude that lh(tn5 ) ≤ ph (lh(h) + lh(t11 ) + lh(t12 ) + 1 + lh(t13 ) + qh (lh(t11 ) + lh(t12 ) + lh(t13 )) + 2 · lh(t14 ) + lh(t15 )). Based on assertions 1-3, it is trivial to construct a polynomial pf verifying the theorem’s assertion. Now, the desired result is an almost immediate consequence of the previous theorem. Corollary 2. For all f ∈ P S any RP S reduction strategy yields an algorithm for π(f ) which runs in polynomial space. Proof. As we have already observed, every ground term in normal form is a numeral. Thus given f ∈ P S, for any RP S reduction strategy we adopt and for all numerals m, ¯ n ¯ , we have a chain f (m; ¯ n ¯ ) → t2 → · · · → tn such that tn is a numeral. Moreover, tn = π(f )(m; ¯ n ¯ ). Now, let pf be a polynomial given by ≤ pf (lh(f (m; ¯ n ¯ ))) = the previous ≤ i ≤ n lh(ti ) theorem. One has that: ∀2 pf (lh(f ) + j lh(mj ) + j lh(nj )) = p ( (|m | + 1) + (|n | + 1) + lh(f )). f j j j j Therefore, setting p∗f (|m|, ¯ |¯ n|) = pf ( j (|mj | + 1) + j (|nj | + 1) + lh(f )), it is ¯ n ¯ , dominates the obvious that the polynomial p∗f , in the binary lengths of m, length of any ti , 2 ≤ i ≤ n. Remarks We would like to emphasize the importance of the bound established in lemma 4. Let us recall it here: For all f ∈ P S there exists a polynomial, qf , with natural coeﬃcients such that ∀¯ r, s¯ ∈ G(P S) |π(f (¯ r; s¯))| ≤ max{qf (|π(¯ r)|), maxi |π(si )|}.

Implicit Characterizations of Pspace

185

This lemma is used in a essential way in the proof of theorem 1. If we had only something like |π(f (¯ r; s¯))| ≤ qf (|π(¯ r)|) + maxi |π(si )| — which is the bound for Ptime functions carried out by Bellantoni and Cook in [4] and used by Beckmann and Weiermann in [1] — we could not maintain the ﬁnal, and also the most delicate, part of the reasoning performed in the proof of theorem 1. The term rewriting characterizations can be used to achieve inclusion relations between classes of complexity, as claimed in [1]. Basically, they have been used to give simple and elegant proofs of known statements. An example of that is the alternative proof of the Bellantoni’s result stating that Ptime is closed under safe recursion with parameter substitution, see [1]. For similar results involving the primitive recursive functions we refer to [8]. 3.6

Unsorted Characterization

Pspace may also be implicitly characterized without using bounded schemes nor sorted function systems. That is the case of the characterization of Pspace given in [17]. There, an unbounded variation of the bounded characterization of Pspace described in section 3.2 is considered, and a purely syntactic measure of complexity, σ, is deﬁned over the function terms. Pspace is identiﬁed with the terms which have rank-σ at most one. Intuitively, σ has to distinguish, for instance, when the binary successor S1 is taken as step-function in a primitive recursion or in a recursion on notation scheme. In the ﬁrst case σ must increase drastically, because S1 together with primitive recursion leads us out of Pspace. However, σ should not increase drastically when, for example, the binary predecessor P is taken as step-function in a primitive recursion. Thus, σ should be accurate enough to distinguish recursion schemes and, for each recursion scheme, to identify “dangerous” and “non-dangerous” step-functions. Some other ranks had already been considered to characterize other classes of functions — see, for instance, [5] and [13]. The Term System T∗P s Let T∗P s be the set of lambda expressions of type level at most 1 formed by lambda abstraction and application using ground-type variables V , the “initial” constant symbols I = {, S0 , S1 , s, P, p, C, B}, and recursion constant symbols RN and PR. Each constant symbol has the arity and type implied by the expressions used below, with the left and right sides of each conversion rule having ground type: s → S0 s (S0 x) → S1 x s (S1 x) → S0 (s x) P → P (S0 x) → x P (S1 x) → x

186

I. Oitavem

p → p (S0 ) → p (S0 (S0 x)) → S1 (p (S0 x)) p (S0 (S1 x)) → S1 (p (S1 x)) p (S1 x) → S0 x C u v w → u C (S0 x) u v w → v C (S1 x) u v w → w B x z → x B x (Si y) → S1 x , i ∈ {0, 1} B x (Si y) (Sj z) → B (Sj x) y z , i, j ∈ {0, 1} RN g h → g RN g h (S0 x) → h (S0 x) (RN g h x) RN g h (S1 x) → h (S1 x) (RN g h x) PR g h → g PR g h (sx) → h (sx) (PR g h x) Of course we also have (λx r)s → r[s/x]. We restrict ourselves to type level at most 1 expressions, and by “term” in the following we mean such an expression. Every term in T∗P s has one of the following forms: an element of I ∪ V ; or (λx t); or ((RN g) h); or ((PR g) h); or (rs) with s of ground type. Rank of Terms For any term t, any integer 1 ≤ i ≤ arity(t), and any variable x ∈ F V (t), we deﬁne σ(t; i) and σ(t; x). σ(t; i) is the rank of the ith input of t, while σ(t; x) is the rank of variable x ∈ F V (t). Note that σ is undeﬁned outside this domain. In the following, for terms r, s, 1 ≤ i ≤ arity(r) and x ∈ F V (s), Kr,i,s,x abbreviates the characteristic function of σ(r; i) > σ(s; x) ∧ s = λ¯ y .x, i.e. 1 if σ(r; i) > σ(s; x) ∧ s = λ¯ y .x Kr,i,s,x = 0 otherwise. We deﬁne:

σ(r; z) if i = 1 σ(r; i − 1) if i > 1 σ(λz.r; x) = σ(r; x) if x is not z σ(rs; i) = σ(r; i+ 1), for s of ground type  σ(r; 1) + Kr,1,s,x σ(rs; x) = max σ(s; x) , for s of ground type.  σ(r; x) σ(λz.r; i) =

Implicit Characterizations of Pspace

187

The clauses above are simply intended to switch back and forth between free variables and inputs reﬂecting the safe composition constraints. Notice that, so far, the only instance which might increase the rank is σ(r; 1) + Kr,1,s,x , in the clause for σ(rs; x). The rank becomes greater than one whenever x of rank σ(s; x) in s goes, via s, into a higher rank position of r. The remaining clauses deﬁning σ specify the way in which σ counts recursions. Let I ∗ be the “initial” constants except S0 , S1 , s and B. One forces the rank of x in RN g h x to be one more than the integer approximation, with respect to ·, of the rank of the critical position in h. Similarly for PR g h x we use ·1 . σ(Si ; 1) σ(s; 1) σ(B; i) σ(B; 3) σ(D; i) σ(x; x)

= 1/2, =1 = 1, =0 = 0, = 0,   σ(h; 1) σ(RNgh; 1) = max σ(g; 1)  1 + σ(h; 2)

for i ∈ {0, 1} for i ∈ {1, 2} for D ∈ I ∗ , 1 ≤ i ≤ arity(D) for x ∈ V

 σ(h; x)    σ(h; 2) + Kh,2,g,x σ(RNgh; x) = max  σ(h; 2) + Kh,2,h,x    σ(g; x)  σ(h; 1) σ(PRgh; 1) = max σ(g; 1)   1 + σ(h; 2) σ(h; x)    σ(h; 2) + Kh,2,g,x σ(PRgh; x) = max σ(h; 2) + Kh,2,h,x    σ(g; x) Deﬁne σ(t) = max({σ(t; i) : 1 ≤ i ≤ arity(t)} ∪ {σ(t; x) : x ∈ F V (t)} ∪ {0}). Undeﬁned terms are omitted from the maximums above. When all clauses are undeﬁned, then the maximum is undeﬁned. Deﬁnition 5. TP s := {t ∈ T∗P s : σ(t) ≤ 1}. Let us open a parenthesis here to deﬁne a few T∗P s terms which may clarify the intended meaning of σ(t) ≤ 1. In the following, when deﬁning a term using recursion, we write it informally using equations rather than explicitly using the constants RN and PR. For i ∈ {0, 1}, let us consider the following functions 1

n is the rounding-down of n, i.e. the integer part, whereas n is the rounding-up.

188

I. Oitavem

deﬁned by recursion on notation: ⊕x=x (Si y) ⊕ x = Si (y ⊕ x) ⊗x= (Si y) ⊗ x = x ⊕ (y ⊗ x) e() = S1 () e(Si x) = e(x) ⊕ e(x) One has σ(⊕) = 1, essentially because σ(S0 ) = σ(S1 ) = 1/2. The second input x of y ⊕ x has rank 1/2, and this is the critical position used in the recursion deﬁning ⊗. One then gets σ(⊗; 1) = 1 + σ(⊕; 2) = 1 and σ(⊗; 2) = σ(⊕; 1), leading to σ(⊗) = 1. On the other hand, σ(e) = 2 due to the fact that e is deﬁned by a recursion through the rank 1 input of ⊗. The reason why we deﬁned σ(Si ; 1) = 1/2 should now become clear. If Si is used in a recursion (in a meaningful way) then one would have σ(h; 2) ≥ 1/2. Consequently σ(RNgh; 1) might be less or equal than 1, but σ(PRgh; 1) will be greater than 1. This corresponds to the recursion constraints we have in the input-sorted characterizations of Pspace: Si may be used in a full way together with the recursion on notation rule, but the use of Si in a primitive recursion deﬁnition may lead us out of Pspace. For example f (; ) = and f (s(x; ); ) = S1 (; f (x; )) has exponential growth. One has that: Theorem 2. TP s coincides with Pspace. For a proof we address to [17], pp.66-75. The proof is based on the three-input-sorted characterization of Pspace described in section 3.4 — 3-Pspace. The mentioned three-input-sorted characterization results from 2-Pspace by removing the (modiﬁed) product from the initial functions and introducing an additional input position to construct the product inside the class. Notice that in TP s terms may only have rank 1, 1/2 or 0. Thus on one side we have three possible ranks and on the other side we have three possible input sorts. The identiﬁcation of TP s with Pspace results from building up a correspondence between input ranks and input sorts. More precisely, in [17], we prove that: 1. If f (¯ x; y¯; z¯) ∈ 3-Pspace then there exists a term tf ∈ TP s such that x; y¯; z¯]. f (¯ x; y¯; z¯) ≡ tf [¯ Moreover, σ(tf ; xi ) = 1, σ(tf ; yi ) = 1/2 and σ(tf ; zi ) = 0. 2. If t ∈ TP s then there exists a function ft ∈ 3-Pspace such that 1/2

1/2

yt1 , x ¯1t ; y¯t , x ¯t ; y¯t0 , x ¯0t ), t[¯ x]¯ y ≡ ft (¯

Implicit Characterizations of Pspace

189

where y¯ ≡ (y1 , · · · , yn ), n = arity(t), x ¯ is a list of all free variables of t, x ¯0t and 0 y¯t are selected from x ¯ and y¯ corresponding to the rank 0 or undeﬁned rank 1/2 1/2 variables and inputs of t, x ¯t and y¯t are selected corresponding to the rank 1/2 variables and inputs of t, and x ¯1t and y¯t1 are selected corresponding to the rank 1 variables and inputs of t. A ﬁnal note just to mention that the rank described here can be improved, namely by omitting the occurrences of K·,·,·,· in the deﬁnition of σ. 3.7

Final Comments

Implicit characterizations of Pspace were also given, by Leivant and Marion, in [11] and [12]. In [11] Pspace is characterized via a three-sorted system, which uses a scheme of recursion with parameter substitution. In [12] Leivant and Marion use higher type recursion to characterize Pspace. In particular, they show that using higher type recursion one can simulate the scheme of recursion with parameter substitution given in [11]. It is very common to associate schemes of recursion with parameter substitution to classes of parallel computations. We recall here that Pspace (boolean functions) may also be described as a class of parallel computations: alternating polynomial time. The reason to associate schemes of recursion with parameter substitution, instead of “simple” recursion schemes, to classes of parallel computations can be explained as follows: Given a deterministic computation, let T be its transition function. For each conﬁguration c, T (c) is the next conﬁguration. Notice that T (c) is uniquely determined by the computation. If f (t, c) is the t’th conﬁguration starting with c, then f (0, c) = c and f (t + 1, c) = T (f (t, c)). Informally speaking, recursion seems to be appropriate to simulate deterministic computations. Now let us think about parallel computations. Let us say that T1 and T2 are the transition functions of a given parallel computation. Thus, any conﬁguration c has two next conﬁgurations T1 (c) and T2 (c). If f (t, c) are the t’th conﬁgurations starting with c, then f (0, c) = c and f (t + 1, c) = J(f (t, T1 (c)), f (t, T2 (c))), where J is a function that combines conﬁgurations. Therefore, recursion with parameter substitution seems to be appropriate to simulate parallel computations. Nevertheless, we believe that the power of parallel computations can be captured by recursion schemes over trees, without (full) parameter substitution. A characterization of N C in this vein was already achieved, see [6].

References 1. Beckmann A., Weiermann A.: A term rewriting characterization of the polytime functions and related complexity classes, Archive for Mathematical Logic 36, 1996, pp.11-30. 2. Bellantoni S.: Predicative Recursion and Computational Complexity, Ph. D. Dissertation, University of Toronto, 1993.

190

I. Oitavem

3. Bellantoni S.: Predicative Recursion and the Polytime Hierarchy, Feasible Mathematics II, ed. P.Clote and J.B.Remmel, Birkh¨ auser, 1995, pp.15-29. 4. Bellantoni S., Cook S.: A New Recursion-Theoretic Characterization of Polytime Functions, Computational Complexity, vol.2, 1992, pp.97-110. 5. Bellantoni S., Niggl K.-H.: Ranking Primitive Recursions: The Low Grzegorczyk Classes Revisited, SIAM Journal of Computing, vol.29, N.2, 1999, pp.401-415. 6. Bellantoni S., Oitavem I.: Separating NC along the δ axis, submitted. 7. Buss S.: Bounded Arithmetic, Bibliopolis, 1986. 8. Cichon E.A., Weiermann A.: Term rewriting theory for the primitive recursive functions, Annals of Pure and Applied Logic 83, 1997, pp.199-223. 9. Ferreira F.: Polynomial Time Computable Arithmetic and Conservative Extensions, Ph. D. Dissertation, Pennsylvania State University, 1988. 10. Ferreira F.: Polynomial Time Computable Arithmetic, Contemporary Mathematics, Volume 106, 1990, pp.137-156. 11. Leivant D. and Marion J.-Y.: Ramiﬁed Recurrence and Computational Complexity II: Substitution and Poly-space, Computer Science Logic, ed. L.Pacholski and J.Tiuryn, Springer-Verlag, 1995, pp.486-500. 12. Leivant D. and Marion J.-Y.: Ramiﬁed Recurrence and Computational Complexity IV: Predicative functionals and poly-space , Preprint. 13. Niggl K.-H.: The µ-Measure as a Tool for Classifying Computacional Complexity, Archive for Mathematical Logic, vol.39, N.7, 2000, pp.509-514. 14. Oitavem I.: Trˆes assuntos de L´ ogica e Complexidade, Master thesis, Universidade de Lisboa, 1995. 15. Oitavem I.: New recursive characterizations of the elementary functions and the functions computable in polynomial space, Revista Matematica de la Universidad Complutense de Madrid, vol.10, N.1, 1997, pp.109-125. 16. Oitavem I.: A term rewriting characterization of the functions computable in polynomial space, Archive for Mathematical Logic, to appear. 17. Oitavem I.: Classes of Computational Complexity: Implicit Characterizations — a Study in Mathematical Logic, Ph.D. thesis, Universidade de Lisboa, 2001. 18. Papadimitriou C.H.: Computational Complexity, Addison-Wesley Publishing Company, 1994.

Iterate Logic Peter H. Schmitt Universit¨ at Karlsruhe, Institute for Logic, Complexity and Deduction Systems, D-76128 Karlsruhe, Germany. http://i12www.ira.uka.de/ Abstract. We introduce a new logic for ﬁnite ﬁrst-order structures with a linear odering. We study its expressive power. In particular we show that it is strictly stronger than ﬁrst-order logic on ﬁnite structures. We close with a list of open problems.

1

Introduction

The Uniﬁed Modeling Language (UML) is a language for visualizing, specifying, constructing and documenting object-oriented software systems. It has been widely accepted as a standard for modeling software systems and is supported by a great number of CASE tools (Computer Aided Software Engineering tools). The standard document on UML is [12]. The Object Constraint Language (OCL) is part of UML [11]. The only available introduction at the time is [18]. The Object Contraint Language (OCL) is used to describe the semantics of UML with greater precision. It is extensively used in the UML meta model. The available descriptions of OCL fall short of giving a rigorous semantics, and even some syntactic details are not clear. Deﬁciencies have been pointed out e.g. in [14,4, 5,10]. One way to remedy this situation and provide OCL with a precise semantics is via a translation into a known, well understood speciﬁcation language. This approach has been pursued e.g. in [6,3,2,8,9] . As an additional advantage of this approach the translated expressions are frequently used as input to existing tools. The disadvantage is that those not familiar with the target language will gain nothing. This paper grew out of an eﬀort to give a systematic deﬁnition of syntax and semantics of the OCL. This will be pursued elsewhere. Here we aim at a diﬀerent goal, we try to formulate the logical essence behind OCL. Syntax and semantics of an OCL expression depends stongly on an associated UML class diagram. The work presented here is at a level of abstraction where this dependence is no longer directly visible. We arrive at a new kind of logic and study it in its own right.

2

Syntax and Semantics of Lit

In this section we introduce Iterate logic Lit by a series of deﬁnitions following the usual pattern. We will deﬁne the possible signatures Σ, the set of wellR. Kahle, P. Schroeder-Heister, and R. St¨ ark (Eds.): PTCS 2001, LNCS 2183, pp. 191–201, 2001. c Springer-Verlag Berlin Heidelberg 2001

192

P.H. Schmitt

formed terms Tit (Σ) and formulas Lit (Σ) over Σ, the structures M and the interpretation of terms and formulas in a given M. Deﬁnition 1 The signature Σ for an Iterate logic consists of 1. A non-empty set S of sorts. Bool is always an element of S 2. A set C of sorted constant symbols. We use c : S to indicate that c is a constant symbol of sort S. The constants true and f alse of sort Bool are assumed to be available in any signature Σ. 3. A set F of sorted function symbols. we use f : S1 × . . . × Sk → S to indicate that f takes arguments of sort S1 to Sk , respectively, and output values of sort S. We stipulate further that S, Si ∈ S. 4. Function symbols r : S1 × . . . × Sk → Bool of target sort Bool will be called predicate symbols. . 5. For every sort S ∈ S there is a predicate symbol =S : S × S → Bool. . . We will usually just write = instead of =S . 6. The will always be function symbols – ∧ : Bool × Bool → Bool – ∨ : Bool × Bool → Bool – ⇒: Bool × Bool → Bool – ¬ : Bool → Bool in Σ 7. There will always be a binary predicate symbol < in Σ. We will later insist that < is always interpreted as a linear order. There is for every sort S an inﬁnite collection of variables V arS of sort S. Deﬁnition 2 Terms and their sorts over Σ are deﬁned as follows. Terms of sort Bool will be called formulas. 1. If c is a constant symbol of sort S then c is a term of sort S, 2. For every variable x ∈ V arS the expression x is a term of sort S, 3. If f ∈ F is a function symbol with signature f : S1 × . . . × Sk → S and t1 , . . . , tk are terms of sort S1 , . . . , Sk respectively, then f (t1 , . . . ,tk ) is a term of sort S. 4. If – sorts S, T ∈ S, – x ∈ V arS , y ∈ V arT , y diﬀerent from x, – t is a formula not containing y, – t0 a term of sort T not containing x or y, – u a term of sort T , then iterate(x : S; y : T = t0 | u)t is a term of sort T .

Iterate Logic

193

. . 5. If t1 , t2 are terms of the same sort then we write t1 = t2 instead of = (t1 , t2 ). Also the propositional connectives will be written in inﬁx notation, i.e. t1 ∧t2 instead of ∧(t1 , t2 ). Since the syntax of iterator terms involves ﬁve constituent entities it pays to agree on some terminology. Using the notation from clause 4 above, the variable x is called the iterator variable, y the accumulator variable, t is termed the range formula, u the step term and t0 the initial term. Deﬁnition 3 A structure M of Σ consists of a non-empty domain M and an interpretation function I such that 1. I(S) is a non-empty subset of M for every S ∈ S. The universe M of M is the disjoint union of all I(S), S ∈ S. 2. I(c) ∈ I(S) for every (c : S) ∈ C. 3. for every (f : S1 × . . . × Sk → S) ∈ F the interpretation I(f ) is a function from I(S1 ) × . . . × I(Sk ) into I(S). . 4. I(=) is the equality relation and the Boolean connectives will have their usual meaning. 5. I(<) is a total linear order on M . Instead of I(<) we will by abuse of notation write < or <M if need arises. Usually we will just write I for the interpretation function. If necessary we will write, more precisely, IM . We note that Deﬁnition 3 is for the greatest part the usual deﬁnition of many-sorted structures. The only particularities are the insistence on having a linear order available, a phenomenon familiar to those working in the area of characterizing complexity classes via logical deﬁnability, and the fact that we will only consider ﬁnite structures. Deﬁnition 4 Let M = (M, I) be a ﬁnite structure. The interpretation function I is extended to terms and formulas. As usual we need valuations β : V arS → I(S) of free variables for all S ∈ S. For a term t of sort S ∈ S Iβ (t) will be an element of I(S). 1. if t ∈ V arS then Iβ (t) = β(t), 2. Iβ (f (t1 , . . . , tk )) = I(f )(Iβ (t1 ), . . . , Iβ (tk )). 3. the interpretation m = Iβ (iterate(x : S; y : T = t0 | u)t) is computed as follows. Let {a1 , . . . , an } = {a ∈ I(S) | Iβxa (t) = true} with a1 < . . . < an . We deﬁne mi for 0 ≤ i < n by: a) m0 = Iβ (t0 ) b) mi+1 = Iβ i+1 (u) where   β(z) if z = x, y i+1 β (z) = ai+1 if z = x  mi if z = y (Observe that mi ∈ I(T ) for all i.)

194

P.H. Schmitt

Now we set m = mn . . 4. Iβ (t1 = t2 ) = true iﬀ Iβ (t1 ) = Iβ (t2 ). 5. Iβ (A) for A a propositional composition of smaller formulas is deﬁned as usual. Remark: If in the computation of Iβ (iterate(x : S1 ; y : T = t0 | u)t) the set {a ∈ I(S1 ) | Iβxa (t) = true} is empty, then we have, according to the above deﬁnition, Iβ (iterate(x : S1 ; y : T = t0 | u)t) = Iβ (t0 ). Example: To get familiar with Deﬁnition 4 let us evaluate the meaning of the formula iterate(x : S; y : Bool = true | y ∧ u)(true) in structure M = (M, I). In addition to the restrictions on the variables imposed by the syntax deﬁnition of interate-terms, we require that y does not occur in u. The range formula being true we obtain as the basis of iteration the set of all elements of sort S in M , say a1 < . . . < an . The initial value m0 of the accumulator is the Boolean value true. For the ﬁrst step in the iteration we compute m1 = Iβ 1 (y ∧ u), where β 1 (x) = a1 and β 1 (y) = true. In other words m1 = true if M |= u[a1 ] and m1 = f alse otherwise. We also notice that once the accumulator is assigned the value f alse it will be stuck with this value for the rest of the iteration. Thus the ﬁnal value mn of the accumulator is true if for all ai M |= u[ai ] holds true and f alse otherwise. Summing up, we may use iterate(x : S; y : Bool = true | y ∧ u)(true) as a deﬁnition of the universal quantiﬁcation ∀xS u. Likewise iterate(x : S; y : Bool = f alse | y ∨ u)(true) behaves as ∃xS u. Deﬁnition 5 Let t, s be formulas in Lit , M = (M, I) a ﬁnite structure. 1. t is called valid in M, in symbols M |= t, if for all β Iβ (t) = true. 2. t is called universally valid, in symbols |= t, if it is valid for all ﬁnite structures M. 3. t is a logical consequence of s, in symbols s |= t, if for any ﬁnite structure M such that s is valid in M also t is valid in M. For formulas, i.e. terms t of sort Boolean we will also use notations like (M, β) |= t instead of Iβ (t) = true, or even M |= t[a1 , . . . , ak ] , where x1 , . . . , xk are all free variables in t (listed in some ﬁxed order) and β(xi ) = ai . Deﬁnition 6 We obtain (a syntactic variant of) ﬁrst-order logic LF O with a linear order if we replace item 4 in Deﬁnition 2 by 4. If t is a formula, x a variable of sort S then also ∀xt and ∃xt are formulas. and leave all other clauses unchanged.

Iterate Logic

3

195

Expressive Power of Lit

Having formulated Iterate Logic in the previous section we will now start collecting facts on its expressive power. We will use the following concept for comparing diﬀerent logics with respect to their expressive power. We will only consider logics that use as interpretations structures of the kind deﬁned in Deﬁnition 3. This is no severe restriction since it is met by most logics we are interested in, e.g. ﬁrst-order logic, (monadic) second-order logic, ﬁxed-point logics, transitive closure logics. Deﬁnition 7 We say, logic L2 is as a expressive as L1 , in symbols L1 ≤ L2 if for every formula t1 in L1 there is a formula t2 in L2 such that for all ﬁnite structures M and variable assignments β (M, β) |=1 t1 iﬀ (M, β) |=2 t1 L2 is strictly more expressive than L1 , in symbols L1 < L2 if L1 ≤ L2 and L2 ≤ L1 . The example following Deﬁnition 4 establishes LF O ≤ Lit . We will eventually show that Lit is strictly more expressive than LF O . To prepare the ground we prove two simple deﬁnability lemmas for Lit . Lemma 1. For any formula t and terms t1 , t2 of sort S ∈ S there is an Lit -term s, such that s = (if t then t1 else t2 ) Proof: Set s = iterate(x : S; y : S = t2 | t1 )t where the variables x, y are diﬀerent and do both not occur in t, t1 and t2 . In any structure M = (M, I) we have for all β M if Iβ (t) = true {a ∈ I(S) | Iβxa (t) = true} = ∅ if Iβ (t) = f alse From this we immediately get Iβ (s) =

Iβ (t1 ) if Iβ (t) = true Iβ (t2 ) if Iβ (t) = f alse

Lemma 2. For any function symbol f ∈ Σ there is a formula s(x, y) in Lit , such that for any structure M = (M, I), any β, and any elements a, b ∈ M Iβxa by (s) = true ⇔ there is n ∈ N with n ≤ card(M ) such that b = Iβ (f )n (a)

196

P.H. Schmitt

. Proof: Set s = ∃w((iterate(z; v = x | u)true) = y) where u = if (z < w) then f (v) else v Lemma 2 already suggests that Lit is strictly stronger than ﬁrst-order logic even on ﬁnite structures. But we can do better. For the remainder of this argument, which will come to a conclusion with the proof of Lemma 3, we ﬁx a particular family of signatures ΣA . The parameter A is being looked at as an alphabet, as it is used in formal language theory. For the alphabet A we denote, as usual, the set of all words over A by A∗ . The signature ΣA contains the binary relation symbol <, a constant symbol ﬁrst, a unary, postﬁx function +1 and for every a ∈ A a unary relation symbol Qa (). It does not hurt to assume in addition that ΣA also contains a constant last and a function symbol −1. Furthermore let ΦA be the formula stating that 1. < is a strict linear ordering with ﬁrst and last element, 2. +1 is the successor function on non-maximal elements m and m + 1 = m for the greatest element 3. −1 is the predecessor function on non-minimal elements and ﬁrst −1 = last, 4. for every position p there is exactly one a ∈ A such that Qa (p) is true. Note, the asymmetric behaviour of +1 and −1 at the endpoints. Every ﬁnite model of ΦA has an isomorphic copy whose elements are the natural numbers from 0 to some n. We will only consider models of ΦA in this restricted sense. Then, the set of ﬁnite non-empty words A∗ \ {Λ} is in one-to-one correspondence with the ﬁnite models of ΦA . For w ∈ A∗ \ {Λ} we denote the associated ΣA structure by Mw . We quickly recall the relationship between w and Mw . Full descriptions are contained in the literature quoted in the next paragraph. Let 0, . . . , n − 1 be all the elements of Mw . The cardinality n of Mw equals the length of the word w. The elements i are thought of as the positions in the word w. Mw |= Qa (0) holds true if and only if the ﬁrst letter in w equals a, Mw |= Qb (1) iﬀ the second letter of w equals b and so on. We have to exclude the empty word, Λ, since in our setting the empty model MΛ is not possible. The following formula tanbn in signature ΣA for A = {a, b}. ∃x( ﬁrst < x ∧ x < last ∧ . (iterate(z; v = (if Qa (ﬁrst) then ﬁrst else last) | u)true) = ﬁrst) where u = if (z ≤ x ∧ Qa (z)) then z else (if (z ≤ x ∧ ¬Qa (z)) then last else (if (x < z ∧ ¬Qa (z)) then last else (if (x < z ∧ Qa (z)) then v − 1))) will play the key role in the proof to follow. Lemma 3. For every w ∈ {a, b}∗ , w = Λ and its corresponding model Mw of ΦA : Mw |= tanbn

⇔ w ∈ aan bbn

Iterate Logic

197

Proof of the Lemma: 3 We ﬁrst assume Mw |= tanbn . There is thus a natural number n, ﬁrst = 0 < n < last = k such that m = Iβ (iterate(z; v = ﬁrst | u)true) = ﬁrst with β(x) = n. Unravelling this according to Deﬁnition 4 we get for all 0 ≤ i ≤ k:  i if i ≤ n ∧ Qa (i)    k if i ≤ n ∧ Qb (i) mi = i − 1 if i > n ∧ Qb (i)    k if i > n ∧ Qa (i) We ﬁrst observe that if mi = k for some i then m = mk can never be 0, as claimed. Thus we have vor all i ≤ n Qa (i) and for all i > n Qb (i). Given that, we see that m = n − (k − n) = 0, i.e. k = 2n. Note that the stipulation ﬁrst −1 = last is important here (ﬁrst −1 = ﬁrst would not work). So, we have seen that w is of the form an bn with n > 0. For the reverse implication of the claim, we start with a word w of the form an bn with n > 0 and want to show Mw |= tanbn . As a witnessing element for the leading existential quantiﬁer we use n. The rest is straight forward. The question which classes of words can be deﬁned in ﬁrst-order logic and in monadic second-order logic has been intensively investigated, surveys may be found e.g. in [16,17,13]. By a well-known result of B¨ uchi, the sets of ﬁnite words deﬁnable by monadic second-order logic are precisely the regular sets of words. Now, aan bbn denotes a context-free but not regular language, thus Lemma 3 tells us that Lit ≤ LM onSO . We have already observed that LF O ≤ Lit is true. Thus we also get LF O < Lit . We compare Lit with the transitive closure logic Ltc , that has been introduced by Neil Immerman in [7, Section 3]. Deﬁnition 8 The terms of Ltc are deﬁned as in Deﬁnition 2 exept that clause 4 is replaced by 4. If t is a term of sort S and s is a term of sort Bool, x1 , . . . , xk , y1 , . . . , yk a sequence of distinct variables, and R a relational variable not free in s, then [R(x1 , . . . , xk , y1 , . . . , yk ) ≡ T C(s)]t is also a term in Ltc and of sort S. Deﬁnition 9 Let M = (M, IM ) be a ﬁnite structure, β a variable assignment. In order to deﬁne the interpretation of Ltc -terms in M we only need to deal with the TC-construct [R(x, y) ≡ T C(s)]t. Here x is shorthand for the tupel x1 , . . . , xk of variables, likewise y abbreviates the tupel y1 , . . . , yk of the same length. x1 , . . . , xk and y1 , . . . , yk are 2k diﬀerent variables.

198

P.H. Schmitt

We ﬁrst observe that s introduces a binary relation Rsβ on the set M k via the deﬁnition Rsβ (a, b) ⇔ (M, β) |= s[a, b] Again a abbreviates the tupel a1 , . . . , ak , and b the tupel b1 , . . . , bk . Furthermore we made use of (M, β) |= s[a, b] as a suggestive shorthand for (M, β ) |= s with  if u = xi  ai if u = yi β (u) = bi  β(u) otherwise (Compare the remark following Deﬁnition 5.) Then IM,β ([R(x1 , . . . , xk , y1 , . . . , yk ) ≡ T C(s)]t) = IM∗ ,β (t) where M∗ coincides with M, but in addition IM∗ (R) is the transitive closure of the relation Rsβ . Notice, that the relation symbol R may occur free in t. Remark: The superscript β in Rsβ is neccessary, since x, y may not be all the free variables of s. Lemma 4. Lit ≤ Ltc Proof: We have to produce for every Lit -formula r an Ltc -formula rtc such that for all structures M and variable assignments β (M, β) |=it r ⇔ (M, β) |=tc rtc We will in fact construct for every Lit -term r a Ltc -formula r¯, containing a new additional free variable z such that for all structures M = (M, I) and variable assignments β Iβ (r) = a ⇔ (M, βza ) |=tc r¯ = true If r is a formula, i.e. a term of sort Boolean, then rtc = r¯(true/z) yields the desired translation. Naturally r¯ will be constructed by structural induction. To reduce technical complications, we use always the same reserved variable z as the new variable in r¯ for any r and assume that z does not occur among the variables in Lit . . If r is simply a functional term r = f (x1 , . . . , xn ) then r¯ = (z = f (x1 , . . . , xn )) The only challenging induction step is the case r = iterate(x : S; y : T = t0 | u)t. ¯ such that for all By induction hypothesis there are Ltc -formulas t¯0 and u M = (M, I) and β Iβ (t0 ) = a ⇔ (M, βza ) |=tc t¯0 = true Iβ (u) = a ⇔ (M, βza ) |=tc u ¯ = true

Iterate Logic

199

Since t has to be a term of sort Boolean the induction hypothesis provides us with a Ltc -formula ttc such that for all M and β (M, β) |=it t ⇔ (M, β) |=tc ttc As a ﬁrst step towards the construction of the Ltc -formula r¯ consider the formula e(x1 , x2 , y1 , y2 ) = ∃xttc ∧ [ ¯(y1 /x, x2 /y, y2 /z)) (f irstt (x1 ) ∧ nextt (x1 , y1 ) ∧ t¯0 (x2 /z) ∧ u ∨ (¬f irstt (x1 ) ∧ nextt (x1 , y1 ) ∧ u ¯(y1 /x, x2 /y, y2 /z)) ] with f irstt (x1 ) = ttc (x1 /x) ∧ ¬∃x(ttc ∧ x < x1 ) lastt (x1 ) = ttc (x1 /x) ∧ ¬∃x(ttc ∧ x1 < x) nextt (x1 , y1 ) = ttc (x1 /x) ∧ ttc (y1 /x) ∧ x1 < x2 ∧ ¬∃x(ttc ∧ x1 < x < x2 ) For any terms w, s1 , s2 the term w(s1 /x, s2 /y) denotes the term obtained from w by replacing simultaneously x by s1 and y by s2 . The looked for translation of r can now we deﬁne as r¯ = (¬∃xttc ∧ t¯0 )∨ . (¬∃z1 , z2 (ttc (z1 /x) ∧ ttc (z2 /x) ∧ z1 = z2 ) ∧ ∃x∃w(ttc ∧ t¯0 (w/z) ∧ u ¯(w/y)))∨ . tc tc z2 )∧ ∃z1 , z2 (t (z1 /x) ∧ t (z2 /x) ∧ z1 = [R(x, y) ≡ T C(e)](∃z1 , z2 , z3 (f irstt (z1 ) ∧ lastt (z2 ) ∧ t¯0 (z3 /z) ∧R(z1 , z3 , z2 , z))) Let M be a ﬁnite structure and β a variable assignment. The three disjunctive components of r¯ correspond to the cases that there 1. is no element satisfying the translated range formula ttc , 2. is exactly one element satisfying the translated range formula ttc , 3. are at least two elements satisfying the translated range formula ttc . Obviously the ﬁrst two cases, have been properly dealt with. We assume from . z2 ). We will use the notation now on (M, β) |= ∃z1 , z2 (ttc (z1 /x)∧ttc (z2 /x)∧z1 = from Deﬁnition 4, clause 3 for the evaluation of iterate(x : S; y : T = t0 | u)t in (M, β). Let further re denote the transitive closure of the relation induced by e on M 2 . By the deﬁnition of e we have for any i, 1 ≤ i < n and any pair (b1 , b2 ) in M 2 : (M, β) |= e[ai , mi , b1 , b2 ] iﬀ b1 = ai+1 , b2 = mi+1 This implies for all (b1 , b2 ) ∈ M 2 : re (a1 , m0 , b1 , b2 ) iﬀ b1 = ai and b2 = mi for some i, 1 ≤ i ≤ n From this it is easy to see that the formula [R(x, y) ≡ T C(e)](∃z1 , z2 , z3 (f irstt (z1 ) ∧ lastt (z2 ) ∧ t¯0 (z3 /z) ∧ R(z1 , z3 , z2 , z))) is true in (M, β) if and only if β(z) = mn .

200

P.H. Schmitt

Open Questions We conclude with a set of open questions, whose answers will shed more light on the status of the new logic Lit . All questions concern ﬁnite structures only unless explicitely mentioned otherwise. 1. Can transitive closure be deﬁnied in Lit ? 2. Compare Lit to the Dynamic Logic whose programs are for-programs. This necessitates to adjust Deﬁnition 7, since the Kripke structures needed for the interpretation of formulas in Dynamic logic are diﬀerent from the structures introduced in Deﬁnition 3. 3. Compare Lit to logics with a least-ﬁx-point operator. One wonders if in Deﬁnition 2 one could not have introduced the iterate operator with more than one accumulator, i.e. an operator of the form iterate(x; y 1 = t1 , . . . , y k = tk | u1 , . . . , uk )t. The result of this operator will be read oﬀ from the ﬁrst accumulator. Formally we modify clause 3 of Deﬁnition 4 as follows: The interpretation m = Iβ (iterate(x; y 1 = t1 , . . . , y k = tk | u1 , . . . , uk )t) is computed as follows. Let {a1 , . . . , an } = {a ∈ I(S1 ) | Iβxa (t) = true} with a1 < . . . < an . We deﬁne mji for 1 ≤ j ≤ k, 0 ≤ i < n by: 1. mj0 = Iβ (tj ) 2. mji+1 = Iβ i+1 (uj ) where   β(z) if z = x, y β i+1 (z) = ai+1 if z = x  j mi if z = y j Now we set m = m1n . Let us denote by Lit−n the logic which allows iterators with k accumulators for all k ≤ n. Thus Lit−1 = Lit 5. Is Lit−n+1 more xpressive than Lit−n ? 6. This is more a task than a question. The addition of a linear order to all structures strongly inﬂuences the expressive power of Lit . Are there ways to avoid this? 7. We have restricted the semantics of Lit to ﬁnite structures, mainly for the reason that otherwise iterate-terms may not terminate. Extend the deﬁnition of Lit by allowing terms with undeﬁned values and waive the ﬁniteness restriction.

References 1. ACM, editor. Conference on Object-Oriented Programming, Systems, Languages, and Applications, OOPSLA ’99, volume 34 (10) of ACM SIGPLAN notices. ACM, ACM Press, 1999.

Iterate Logic

201

2. R. France. A problem-oriented analysis of basic uml static modeling concepts. In ACM [1]. 3. M. Gogolla and M. Richters. On constraints and queries in UML. In Schader and Korthaus [15], pages 109–121. 4. A. Hamie. A formal semantics for checking and analysing UML models. In L. Andrade, A. Moreira, A. Deshpande, and S. Kent, editors, Proceedings of the OOPSLA’98 Workshop on Formalizing UML. Why? How?, 1998. 5. A. Hamie, J. Howse, and S. Kent. Navigation expressions in object-oriented modelling. In FASE’98. 6. A. Hamie, J. Howse, and S. Kent. Interpreting the object constraint language. In Proceedings of Asia Paciﬁc Conference in Software Engineering. IEEE Press, July 1998. 7. N. Immerman. Languages that capture complexity classes. SIAM J. of Computing, 16(4):760–778, 1987. 8. S.-K. Kim and D. Carrington. Formalizing the UML class diagram using Object-Z. volume 1723 of LNCS, pages 83–98. Springer, 1999. 9. P. Krishnan. Consistency Checks for UML. In Proceedings of the Asia Paciﬁc Software Engineering Conference (APSEC 2000), pages 162–169, December 2000. 10. L. Mandel and M. V. Cengarle. On the expressive power of OCL. In FM’99 - Formal Methods. World Congress on Formal Methods in the Development of Computing Systems, Toulouse, France, September 1999. Proceedings, Volume I, volume 1708 of LNCS, pages 854–874. Springer, 1999. 11. OMG. Object constraint language speciﬁcation, version 1.3. chapter 7 in [12]. OMG Document, March 2000. 12. OMG. OMG uniﬁed modeling language speziﬁcation, version 1.3. OMG Document, March 2000. 13. J.-E. Pin. Logic on words. Bulletin of the EATCS, 54:145–165, 1994. 14. M. Richters and M. Gogolla. On formalizing the UML object constraint language OCL. In T. W. Ling, S. Ram, and M. L. Lee, editors, Proc. 17th Int. Conf. Conceptual Modeling (ER’98), pages 449–464. Springer, Berlin, LNCS 1507, 1998. 15. M. Schader and A. Korthaus, editors. The Uniﬁed Modeling Language: technical aspects and applications. Physica-Verlag, 1998. 16. H. Straubing. Finite Automata, Formal Logic, and Circuit Complexity. Progress in Theoretical Computer Science. Birkh¨ auser, 1994. 17. W. Thomas. Automata on inﬁnite objects. In J. van Leeuwen, editor, Handbook of Theoretical Computer Science. Vol. B : Formal Models and Semantics, pages 135–192. Elsevier, Amsterdam, 1990. 18. J. Warmer and A. Kleppe. The Object Constraint Language: Precise Modelling with UML. Object Technology Series. Addison-Wesley, Reading/MA, 1999.

Constructive Foundations for Featherweight Java Thomas Studer Crosspoint Informatik AG Zentrumsplatz 1 CH-3322 Sch¨ onb¨ uhl, Switzerland [email protected]

Abstract. In this paper we present a recursion-theoretic denotational semantics for Featherweight Java. Our interpretation is based on a formalization of the object model of Castagna, Ghelli and Longo in a predicative theory of types and names. Although this theory is proof-theoretically weak, it allows to prove many properties of programs written in Featherweight Java. This underpins Feferman’s thesis that impredicative assumptions are not needed for computational practice. Keywords: object-oriented programming, denotational semantics, reasoning about programs, Featherweight Java, explicit mathematics

1

Introduction

The question of the mathematical meaning of a program is usually asked to gain more insight into the language the program is written in. This may be to bring out subtle issues in language design, to derive new reasoning principles or to develop an intuitive abstract model of the programming language under consideration so as to aid program development. Moreover, a precise semantics is also needed for establishing certain properties of programs (often related to some aspects concerning security) with mathematical rigor. As far as the Java language is concerned, most of the research on its semantics is focused on the operational approach (cf. e.g. St¨ ark, Schmid and B¨ orger [36], Cenciarelli, Knapp, Reus and Wirsing [11], Drossopoulou, Eisenbach and Khurshid [12], Nipkow and Oheimb [30], and Syme [40]). Notable exceptions are Oheimb [31] who introduces a Hoare-style calculus for Java as well as Alves-Foss and Lam [2] who present a denotational semantics which is, as usual, based on domain-theoretic notions, cf. e.g. Fiore, Jung, Moggi, O’Hearn, Riecke, Rosolini and Stark [19] for a recent survey on domains and denotational semantics. Also, the projects aiming at a veriﬁcation of Java programs using modern CASE tools and theorem provers have to make use of a formalization of the Java language (cf. e.g. the KeY approach by Ahrendt, Baar, Beckert, Giese, Habermalz, H¨ahnle, Menzel and Schmitt [1] as well as the LOOP project by Jacobs, van den Berg, Huisman, van Berkum, Hensel and Tews [25]).

Research supported by the Swiss National Science Foundation. This paper is a part of the author’s dissertation thesis [38].

R. Kahle, P. Schroeder-Heister, and R. St¨ ark (Eds.): PTCS 2001, LNCS 2183, pp. 202–238, 2001. c Springer-Verlag Berlin Heidelberg 2001

Constructive Foundations for Featherweight Java

203

The main purpose of the present paper is the study of a recursion-theoretic denotational semantics for Featherweight Java, called FJ. Igarashi, Pierce and Wadler [24,23] have proposed this system as a minimal core calculus for Java, making it easier to understand the consequences of extensions and variations. For example, they employ it to prove type safety of an extension with generic classes as well as to obtain a precise understanding of inner classes. Ancona and Zucca [4] present a module calculus where the module components are class declarations written in Featherweight Java; and the introductory text by Felleisen and Friedman [18] shows that many useful object-oriented programs can be written in a purely functional style a` la Featherweight Java. In order to give a denotational semantics for FJ, we need to formalize an object model. Often, models for statically typed object-oriented programming languages are based on a highly impredicative type theory. Bruce, Cardelli and Pierce [7] for example use Fω <: as common basis to compare diﬀerent object encodings. A new approach to the foundations of object-oriented programming has been proposed by Castagna, Ghelli and Longo [8,10,21] who take overloading and subtyping as basic rather than encapsulation and subtyping. Although in its full generality this approach leads to a new form of impredicativity, see Castagna [8] and Studer [39], only a predicative variant of their system is needed in order to model object-oriented programming. This predicative object model will be our starting point for constructing a denotational semantics for Featherweight Java in a theory of types and names. Theories of types and names, or explicit mathematics, have originally been introduced by Feferman [13,14] to formalize Bishop style constructive mathematics. In the sequel, these systems have gained considerable importance in proof theory, particularly for the proof-theoretic analysis of subsystems of second order arithmetic and set theory. More recently, theories of types and names have been employed for the study of functional and object-oriented programming languages. In particular, they have been shown to provide a unitary axiomatic framework for representing programs, stating properties of programs and proving properties of programs. Important references for the use of explicit mathematics in this context are Feferman [15,16,17], Kahle and Studer [29], St¨ ark [34, 35], Studer [37,39] as well as Turner [43,44]. Beeson [6] and Tatsuta [41] make use of realizability interpretations for systems of explicit mathematics to prove theorems about program extraction. Feferman [15] claims that impredicative comprehension principles are not needed for applications in computational practice. Further evidence for this is also given by Turner [44] who presents computationally weak but highly expressive theories, which suﬃce for constructive functional programming. In our paper we provide constructive foundations for Featherweight Java in the sense that our denotational semantics for FJ will be formalized in a constructive theory of types and names using the predicative object model of Castagna, Ghelli and Longo [10]. This supports Feferman’s thesis that impredicative assumptions are not needed. Although our theory is proof-theoretically weak we can prove soundness of our semantics with respect to subtyping, typing and reductions.

204

T. Studer

Moreover, the theory of types and names we use has a recursion-theoretic interpretation. Hence, computations in FJ will be modeled by ordinary computations. For example, a non-terminating computation is not interpreted by a function, which yields ⊥ as result, but by a partial function which does not terminate, either. The plan of the present paper is as follows. In the next section we introduce the general framework of theories of types and names and we show how to construct ﬁxed point types in it. Further we recall a theorem about a least ﬁxed point operator in explicit mathematics, which will be the crucial ingredient of our construction. The presentation of Featherweight Java in Section 3 is included in order to make this paper self-contained. The overloading based object model we employ for our interpretation is introduced in Section 4. Section 5 is concerned with the study of some examples written in FJ which will motivate our denotational semantics as presented in Section 6. Section 7 contains the soundness proofs of our semantics with respect to subtyping, typing and reductions. A conclusion sums up what we have achieved and suggest further work, in particular the extension to the dynamic deﬁnition of new classes.

2

Theories of Types and Names

Explicit Mathematics has been introduced by Feferman [13] for the study of constructive mathematics. In the present paper, we will not work with Feferman’s original formalization of these systems; instead we treat them as theories of types and names as developed in J¨ager [26]. First we will present the base theory EETJ. Then we will extend it with the principle of dependent choice and show that this implies the existence of certain ﬁxed points. Last but not least we are going to add axioms about computability and the statement that everything is a natural number. These two additional principles make the deﬁnition of a least ﬁxed point operator possible. 2.1

Basic Notions

The theory of types and names which we will consider in the sequel is formulated in the two sorted language L about individuals and types. It comprises individual variables a, b, c, f, g, h, x, y, z, . . . as well as type variables A, B, C, X, Y, Z, . . . (both possibly with subscripts). The language L includes the individual constants k, s (combinators), p, p0 , p1 (pairing and projections), 0 (zero), sN (successor), pN (predecessor), dN (deﬁnition by numerical cases) and the constant c (computation). There are additional individual constants, called generators, which will be used for the uniform representation of types. Namely, we have a constant ce (elementary comprehension) for every natural number e, as well as the constants j (join) and dc (dependent choice). The individual terms (r, s, t, r1 , s1 , t1 , . . . ) of L are built up from the variables and constants by means of the function symbol · for (partial) application. We

Constructive Foundations for Featherweight Java

205

use (st) or st as an abbreviation for (s·t) and adopt the convention of association to the left, this means s1 s2 . . . sn stands for (. . . (s1 · s2 ) . . . sn ). Finally, we deﬁne general n tupling by induction on n ≥ 2 as follows: (s1 , s2 ) := ps1 s2

and

(s1 , s2 , . . . , sn+1 ) := (s1 , (s2 , . . . , sn+1 )).

The atomic formulas of L are s↓, N(s), s = t, s ∈ U and (s, U ). Since we work with a logic of partial terms, it is not guaranteed that all terms have values, and s↓ is read as s is deﬁned or s has a value. Moreover, N(s) says that s is a natural number, and the formula (s, U ) is used to express that the individual s represents the type U or is a name of U . The formulas of L are generated from the atomic formulas by closing against the usual propositional connectives as well as quantiﬁcation in both sorts. A formula is called elementary if it contains neither the relation symbol nor bound type variables. The following table contains a list of useful abbreviations, where F is an arbitrary formula of L: st s = t

:= :=

s↓ ∨ t↓ → s = t, s↓ ∧ t↓ ∧ ¬(s = t),

s∈N (∃x ∈ A)F (x)

:= :=

N(s), ∃x(x ∈ A ∧ F (x)),

(∀x ∈ A)F (x) f ∈ (A → B)

:= :=

∀x(x ∈ A → F (x)), (∀x ∈ A)f x ∈ B,

A⊂B A=B

:= :=

∀x(x ∈ A → x ∈ B), A ⊂ B ∧ A ⊂ B,

f ∈ (A B) x∈A∩B s ∈˙ t ˙ t s⊂

:= :=

∀x(x ∈ A ∧ f x↓ → f x ∈ B), x ∈ A ∧ x ∈ B,

s= ˙ t

:= := :=

(∃x ∈˙ s)F (x) (∀x ∈˙ s)F (x)

:= :=

∃X((t, X) ∧ s ∈ X), (∀x ∈˙ s)x ∈˙ t, ˙ t∧t⊂ ˙ s, s⊂ ∃x(x ∈˙ s ∧ F (x)), ∀x(x ∈˙ s → F (x)),

(s) f ∈ ( → )

:= :=

∃X(s, X), ∀x((x) → (f x)).

is sometimes used to denote ﬁnite sequences Z1 , . . . Zn of The vector notation Z is then either given by the context expressions. The length of such a sequence Z = U1 , . . . , Un and s = s1 , . . . , sn we write or irrelevant. For example, for U ) := (s1 , U1 ) ∧ . . . ∧ (sn , Un ), (s, U (s) := (s1 ) ∧ . . . ∧ (sn ). Now we introduce the theory EETJ which provides a framework for explicit elementary types with join. Its logic is Beeson’s [5] classical logic of partial terms

206

T. Studer

for individuals and classical logic for types. The logic of partial terms takes into account the possibility of undeﬁned terms, i.e. terms which represent nonterminating computations. Scott [33] has given a logic similar to the logic of partial terms, but he treats existence like an ordinary predicate. Troelstra and van Dalen [42] give a discussion about the diﬀerent approaches to partial terms. Among the main features of the logic of partial terms are its strictness axioms stating that if a term has a value, then all its subterms must be deﬁned, too. This corresponds to a call-by-value evaluation strategy, where all arguments of a function must ﬁrst be fully evaluated before the ﬁnal result will be computed. St¨ ark [34,35] examines variants of the logic of partial terms which also allow of call-by-name evaluation. The nonlogical axioms of EETJ can be divided into the following three groups. I. Applicative axioms. These axioms formalize that the individuals form a partial combinatory algebra, that we have paring and projections and the usual closure conditions on the natural numbers as well as deﬁnition by numerical cases. (1) (2) (3) (4) (5) (6) (7) (8) (9)

kab = a, sab↓ ∧ sabc ac(bc), p0 a↓ ∧ p1 a↓, p0 (a, b) = a ∧ p1 (a, b) = b, 0 ∈ N ∧ (∀x ∈ N)(sN x ∈ N), (∀x ∈ N)(sN x = 0 ∧ pN (sN x) = x), (∀x ∈ N)(x = 0 → pN x ∈ N ∧ sN (pN x) = x), a ∈ N ∧ b ∈ N ∧ a = b → dN xyab = x, a ∈ N ∧ b ∈ N ∧ a = b → dN xyab = y.

II. Explicit representation and extensionality. The following are the usual ontological axioms for systems of explicit mathematics. They state that each type has a name, that there are no homonyms and that respects the extensional equality of types. Note that the representation of types by their names is intensional, while the types themselves are extensional in the usual set-theoretic sense. (10) ∃x(x, A), (11) (s, A) ∧ (s, B) → A = B, (12) A = B ∧ (s, A) → (s, B). III. Basic type existence axioms. be an elementary formula of L with Elementary Comprehension. Let F (x, y , Z) at most the indicated free variables and with G¨ odelnumber e for any ﬁxed G¨ odelnumbering, then we have the following axioms: (13) (b) → (ce (a, b)), (14) (b, T ) → ∀x(x ∈˙ ce (a, b) ↔ F (x, a, T )). With elementary comprehension we get a universal type V containing every individual. Simply let F be the elementary formula x = x and apply the above axioms.

Constructive Foundations for Featherweight Java

207

Join. (15) (a) ∧ (∀x ∈˙ a)(f x) → (j(a, f )) ∧ Σ(a, f, j(a, f )). In this axiom the formula Σ(a, f, b) means that b names the disjoint union of f over a, i.e. Σ(a, f, b) := ∀x(x ∈˙ b ↔ ∃y∃z(x = (y, z) ∧ y ∈˙ a ∧ z ∈˙ f y)). It is a well-known result that we can introduce λ abstraction and recursion using the combinator axioms for k and s, cf. Beeson [5] or Feferman [13]. Theorem 1. 1. For every variable x and every term t of L, there exists a term λx.t of L whose free variables are those of t, excluding x, such that EETJ λx.t↓ ∧ (λx.t) x t and EETJ s↓ → (λx.t) s t[s/x]. 2. There exists a term rec of L such that EETJ rec f ↓ ∧ ∀x(rec f x f (rec f ) x). Now we introduce non-strict deﬁnition by cases (cf. e.g. Beeson [5]). Observe that if dN abcd↓, then a↓ and b↓ hold by strictness. However, we often want to deﬁne a function by cases so that it is deﬁned if one case holds, even if the value that would have been computed in the other case is undeﬁned. Hence we let ds abcd stand for the term dN (λz.a)(λz.b)cd0 where the variable z does not occur in the terms a and b. We will use the following notation for non-strict deﬁnition by cases a if c = d, ds abcd b else. This notation already anticipates the axiom ∀xN(x), otherwise we should add N(c) ∧ N(d) as a premise; and of course, strictness still holds with respect to u and v. We have ds rsuv↓ → u↓ ∧ v↓. If u or v is undeﬁned, then ds rsuv is also undeﬁned. However, if r is a deﬁned term and u and v are deﬁned natural numbers that are equal, then ds rsuv = r holds even if s is not deﬁned. In the sequel we employ type induction on the natural numbers which is given by the following axiom (T-IN ): ∀X(0 ∈ X ∧ (∀x ∈ N)(x ∈ X → sN x ∈ X) → (∀x ∈ N)x ∈ X). 2.2

Fixed Point Types

The classes of Java will be modeled by types in explicit mathematics. Since the Java classes may be deﬁned by mutual recursion, i.e. class A may contain an attribute of class B and vice versa, their interpretations have to be given as ﬁxed point types in our theory of types and names. They can be constructed by the principle of dependent choice (dc). These axioms have been proposed by J¨ ager and their proof-theoretic analysis has been carried out by Probst [32].

208

T. Studer

Dependent choice. (dc.1) (a) ∧ f ∈ ( → ) → dc(a, f ) ∈ (N → ), (dc.2) (a) ∧ f ∈ ( → ) → dc(a, f )0 a ∧ (∀n ∈ N)dc(a, f )(n + 1) f (dc(a, f )n). First, let us introduce some notation. By primitive recursion we can deﬁne in EETJ + (T-IN ) the usual relations < and ≤ on the natural numbers. The ith section of U is deﬁned by (U )i := {y | (i, y) ∈ U }. If s is a name for U , then (s)i represents the type (U )i . By abuse of notation, we let the formula (s)i ∈ U stand for p0 s = i ∧ p1 s ∈ U . The context will ensure that it is clear how to read (s)i . Product types are deﬁned according to the deﬁnition of n tupling by S1 × S2 := {(x, y) | x ∈ S1 ∧ y ∈ S2 } and S1 × S2 × · · · × Sn+1 := S1 × (S2 × · · · × Sn+1 ). We deﬁne projection functions πik for k ≥ 2 and 1 ≤ i ≤ k so that πik (s1 , . . . , sk ) si . A ﬁxed point speciﬁcation is a system of formulas of the form (X)1 = Y11 × · · · × Y1m1 .. . (X)n = Yn1 × · · · × Ynmn where each Yij may be any type variable other than X or of the form {x ∈ X | p0 x = k1 } ∪ · · · ∪ {x ∈ X | p0 x = kl } for ki ≤ n. Those Yij which are just a type variable other than X are called parameters of the speciﬁcation. Our aim is to show that for every ﬁxed point speciﬁcation there exists a ﬁxed point satisfying it and this ﬁxed point can be named uniformly in the parameters of its speciﬁcation. . Assume we are given a ﬁxed point speciﬁcation as above with parameters Y Then we ﬁnd by elementary comprehension that there exists a closed individual term t of L so that EETJ proves for all a whose length is equal to the number of parameters of the speciﬁcation: 1. (a) ∧ (b) → (t(a, b)), ) ∧ (b, X) → 2. (a, Y ∀x(x ∈˙ t(a, b) ↔ (x)1 ∈ Y11 × · · · × Y1m1 ∨ . . . ∨ (x)n ∈ Yn1 × · · · × Ynmn ). In the following we assume (a) and let aij denote that element of a which represents Yij . The term λx.t(a, x) is an operator form mapping names to names. Note that it is monotonic, i.e. ˙ c → t(a, b) ⊂ ˙ t(a, c). b⊂

(1)

Constructive Foundations for Featherweight Java

209

Starting from the empty type, represented by ∅, this operation can be iterated in order to deﬁne the stages of the inductive deﬁnition of our ﬁxed point. To do so, we deﬁne a function f by: f (a, n) dc(∅, λx.t(a, x))n. As a direct consequence of (dc.1) we ﬁnd (∀n ∈ N)(f (a, n)). Hence, we let J be the type represented by j(nat, λx.f (a, x)). Making use of (T-IN ) we can prove (∀n ∈ N)∀x((n, x) ∈ J → (n + 1, x) ∈ J) and therefore ˙ f (a, n)). (∀m ∈ N)(∀n ∈ N)(m ≤ n → f (a, m) ⊂

(2)

We deﬁne the ﬁxed point FP := {x | (∃n ∈ N)(n, x) ∈ J}. By the uniformity of elementary comprehension and join there exists a closed individual term fp so that fp(a) is a name for FP, i.e. the ﬁxed point can be represented uniformly in its parameters. A trivial corollary of this deﬁnition is (∃n ∈ N)(x ∈˙ f (a, n)) ↔ x ∈˙ fp(a).

(3)

The following theorem states that FP is indeed a ﬁxed point of t. We employ (s)ij ∈ U as abbreviation for p0 s = i ∧ πjmi (p1 s) ∈ U . Theorem 2. It is provable in EETJ + (dc) + (T-IN ) that FP is a ﬁxed point satisfying the ﬁxed point speciﬁcation, i.e. (a) → ∀x(x ∈˙ fp(a) ↔ x ∈˙ t(a, fp(a)). Proof. Assume x ∈˙ fp(a). By (3) there exists a natural number n so that x ∈˙ f (a, n). By (2) we ﬁnd x ∈ f (a, n + 1) and by the deﬁnition of f we get f (a, n + ˙ fp(a) and with (1) we conclude x ∈ 1) = t(a, f (a, n)). By (3) we obtain f (a, n) ⊂ t(a, fp(a)). Next, we show ∀x(x ∈˙ t(a, fp(a)) → x ∈˙ fp(a)). Let x ∈˙ t(a, fp(a)), i.e. we have for all i, j with 1 ≤ i ≤ n and 1 ≤ j ≤ mi either (x)ij ∈˙ aij or by (3) (x)ij ∈ {y | (∃n ∈ N)y ∈˙ f (a, n) ∧ p0 y = k1 } ∪ · · · ∪ {y | (∃n ∈ N)y ∈˙ f (a, n) ∧ p0 y = kl } depending on the speciﬁcation. Since f is monotonic there exists a natural number n so that for all i, j with 1 ≤ i ≤ n and 1 ≤ j ≤ mi we have either (x)ij ∈˙ aij or (x)ij is an element of {y | y ∈˙ f (a, n) ∧ p0 y = k1 } ∪ · · · ∪ {y | y ∈˙ f (a, n) ∧ p0 y = kl } depending on the speciﬁcation and this implies x ∈˙ f (a, n+1). Hence we conclude by (3) that x ∈˙ fp(a) holds.

210

2.3

T. Studer

Least Fixed Point Operator

As shown in Theorem 1 the combinatory axioms of EETJ provide a term rec which solves recursive equations. However, it is not provable that the solution obtained by rec is minimal. Here we are going to extend EETJ + (T-IN ) with axioms about computability (Comp) and the statement that everything is a natural number. The resulting system allows to deﬁne a least ﬁxed point operator and therefore it will be possible to show that recursively deﬁned methods belong to a certain function space, cf. Kahle and Studer [29]. Computability. These axioms are intended to capture the idea that convergent computations should converge in ﬁnitely many steps. In the formal statement of the axioms the expression c(f, x, n) = 0 can be read as “the computation f x converges in n steps.” The idea of these axioms is due to Friedman (unpublished) and discussed in Beeson [5]. Note that these axioms can be satisﬁed in the usual recursion-theoretic model. The constant c can be interpreted by the characteristic function of Kleene’s T predicate. (Comp.1) ∀f ∀x(∀n ∈ N)(c(f, x, n) = 0 ∨ c(f, x, n) = 1), (Comp.2) ∀f ∀x(f x↓ ↔ (∃n ∈ N)c(f, x, n) = 0). In addition we will restrict the universe to natural numbers. This axiom is needed to construct the least ﬁxed point operator. Of course, it is absolutely in the spirit of a recursion-theoretic interpretation. Everything is a number. Formally, this is given by ∀xN(x). For the rest of this section LFP will be the theory EETJ + (Comp) + ∀xN(x) + (T-IN ). We are going to deﬁne ordering relations T for certain types T . The meaning of f T g is that f is smaller than g with respect to the usual pointwise ordering of functions, e.g. we have f AB g → (∀x ∈ A)(f x↓ → f x = gx). Deﬁnition 1. Let A1 , . . . , An , B1 , . . . , Bn be types Further, let T be the type (A1 B1 ) ∩ · · · ∩ (An Bn ). We deﬁne: f g := f ↓ → f = g, f T g := (∀x ∈ Ai )f x gx), 1≤i≤n

f∼ =T g := f T g ∧ g T f. Deﬁnition 2. Let T be as given in Deﬁnition 1. A function f ∈ (T → T ) is called T monotonic, if (∀g ∈ T )(∀h ∈ T )(g T h → f g T f h).

Constructive Foundations for Featherweight Java

211

Using the rec term we will ﬁnd a ﬁxed point for every operation g. But as we have mentioned above we cannot prove in EETJ that this is a least ﬁxed point, and of course, there are terms g that do not have a least ﬁxed point. However, there exists a closed individual term l of L so that LFP proves that lg is the least ﬁxed point of a monotonic functional g ∈ (T → T ). A proof of the following theorem can be found in Kahle and Studer [29]. Theorem 3. There exists a closed individual term l of L such that we can prove in LFP that if g ∈ (T → T ) is T monotonic for T given as in Deﬁnition 1, then 1. lg ∈ T , 2. lg ∼ =T g(lg), 3. f ∈ T ∧ gf ∼ =T f → lg T f . Now we deﬁne the theory PTN about programming with types and names as the union of all these axioms: PTN := EETJ + (dc) + (Comp) + ∀xN(x) + (T-IN ). The axioms about computability can be interpreted in the usual recursiontheoretic model, see Beeson [5] or Kahle [28]. This means that applications a · b in L are translated into {a}(b), where {n} for n = 0, 1, 2, 3, . . . is a standard enumeration of the partial recursive functions. In fact, the computability axioms are motivated by Kleene’s T predicate which is a ternary primitive recursive relation on the natural numbers so that {a}(m) n holds if and only if there exists a computation sequence u with T(a, !m", u) and (u)0 = n. Hence, it can be used to verify the axioms in a recursion-theoretic interpretation; and of course, ∀xN(x) will also be satisﬁed in such a model. Probst [32] presents a recursion-theoretic model for the system EETJ+(dc)+ (T-IN ) and shows that the proof-theoretic ordinal of this theory is ϕω0, i.e. it is slightly stronger than Peano arithmetic but weaker than Martin-L¨ of type theory with one universe ML1 or the system EETJ + (L-IN ) of explicit mathematics with elementary comprehension, join and full induction on the natural numbers. These two constructions can be combined in order to get a recursion-theoretic model for PTN so that computations in PTN are modeled by ordinary recursiontheoretic functions. We obtain that PTN is proof-theoretically still equivalent to EETJ + (dc) + (T-IN ). Hence, PTN is a predicative theory which is prooftheoretically much weaker than the systems that are usually used to talk about object-oriented programming, for most of these calculi are extensions of system F that already contains full analysis, cf. e.g. Bruce, Cardelli and Pierce [7]. Nevertheless, PTN is suﬃciently strong to model Featherweight Java and to prove many properties of the represented programs. In PTN we can also prove soundness of our interpretation with respect to subtyping, typing and reductions.

3

Featherweight Java

Featherweight Java is a minimal core calculus for Java proposed by Igarashi, Pierce and Wadler [24] for the formal study of an extension of Java with parameterized classes. Igarashi and Pierce [23] employed Featherweight Java also

212

T. Studer

to obtain a precise understanding of inner classes. FJ is a minimal core calculus in the sense that as many features of Java as possible are omitted, while maintaining the essential ﬂavor of the language and its type system. Nonetheless, this fragment is large enough to include many useful programs. In particular, most of the examples in Felleisen and Friedman’s text [18] are written in the purely functional style of Featherweight Java. In this section we will present the formulation of Featherweight Java given in [23]. Syntax. The abstract syntax of FJ class declarations, constructor declarations, method declarations and expressions is given by: CL ::= class C extends C {C f; K M} K ::= C (C f) {super(f); this.f = f; } M ::= C m(C x) {return e; } e ::= x | e.f | e.m(e) | new C(e) | (C)e The meta-variables A,B,C,D,E range over class names, f and g range over ﬁeld names, m ranges over method names, x ranges over variable names and d,e range over expressions (all possibly with subscripts). CL ranges over class declarations, K ranges over constructor declarations and M ranges over method declarations. We assume that the set of variables includes the special variable this, but that this is never used as the name of an argument to a method. We write f as shorthand for f1 , . . . , fn (and similarly for C, x, e, etc.) and we use M for M1 . . . Mn (without commas). The empty sequence is written as • and +(x) denotes the length of the sequence x. Operations on pairs of sequences are abbreviated in the obvious way, e.g. “C f” stands for “C1 f1 , . . . , Cn fn ” and “C f;” is a shorthand for “C1 f1 ; . . . ; Cn fn ;” and similarly “this.f = f;” abbreviates “this.f1 = f1 ; . . . ; this.fn = fn ;”. We assume that sequences of ﬁeld declarations, parameter names and method declarations contain no duplicate names. A class table CT is a mapping from class names C to class declarations CL. A program is a pair (CT, e) of a class table and an expression. In the following we always assume that we have a ﬁxed class table CT which satisﬁes the following sanity conditions: 1. CT (C) = class C . . . for every C in the domain of CT , i.e. the class name C is mapped to the declaration of the class C, 2. Object is not an element of the domain of CT , 3. every class C (except Object) appearing anywhere in CT belongs to the domain of CT ,

Constructive Foundations for Featherweight Java

213

4. there are no cycles in the subtype relation induced by CT , i.e. the <: relation is antisymmetric. Subtyping. The following rules deﬁne the subtyping relation <: which is induced by the class table. Note that every class deﬁned in the class table has a super class, declared with extends. C <: C C <: D D <: E C <: E CT (C) = class C extends D {. . . } C <: D Computation. These rules deﬁne the reduction relation −→ which models ﬁeld accesses, method calls and casts. In order to look up ﬁelds and method declarations in the class table we use some auxiliary functions that will be deﬁned later on. We write e0 [d/x, e/this] for the result of simultaneously replacing x1 by d1 , . . . , xn by dn and this by e in the expression e0 . ﬁelds(C) = C f new C(e).fi −→ ei mbody(m, C) = (x, e0 ) new C(e).m(d) −→ eo [d/x, new C(e)/this] C <: D (D)new C(e) −→ new C(e) We say that an expression e is in normal form if there is no expression d so that e −→ d. Now we present the typing rules for expressions, method declarations and class declarations. An environment Γ is a ﬁnite mapping from variables to class names, written x : C. Again, we employ some auxiliary functions which will be given later. Stupid casts (the last of the expression typing rules) are included only for technical reasons, cf. Igarashi, Pierce and Wadler [24]. The Java compiler will reject expressions containing stupid casts as ill typed. This is expressed by the hypothesis stupid warning in the typing rule for stupid casts. Expression typing. Γ x ∈ Γ (x) ﬁelds(C0 ) = C f Γ e0 ∈ C0 Γ e0 .fi ∈ Ci Γ eo ∈ C 0 mtype(m, C0 ) = D → C Γ e∈C C <: D Γ e0 .m(e) ∈ C

214

T. Studer

ﬁelds(C) = D f Γ e∈C C <: D Γ new C(e) ∈ C D <: C Γ e0 ∈ D Γ (C)e0 ∈ C Γ e0 ∈ D C <: D Γ (C)e0 ∈ C

C = D

Γ e0 ∈ D C <: D stupid warning

D <: C

Γ (C)e0 ∈ C Method typing. x : C, this : C e0 ∈ E0 E0 <: C0 CT (C) = class C extends D {. . . } if mtype(m,D) = D → D0 , then C = D and C0 = D0 C0 m (C x) {return e0 ; } OK in C Class typing. K = C(D g, C f) {super(g); this.f = f;} ﬁelds(D) = D g M OK in C class C extends D {C f; K M} OK We deﬁne the auxiliary function which are used in the rules for computation and typing. Field lookup.

ﬁelds(Object) = •

CT (C) = class C extends D {C f; K M}

ﬁelds(D) = D g

ﬁelds(C) = D g, C f Method type lookup. CT (C) = class C extends D {C f; K M} B m (B x) {return e;} belongs to M mtype(m, C) = B → B CT (C) = class C extends D {C f; K M} m is not deﬁned in M mtype(m, C) = mtype(m, D) Method body lookup. CT (C) = class C extends D {C f; K M} B m (B x) {return e; } belongs to M mbody(m, C) = (x, e)

Constructive Foundations for Featherweight Java

215

CT (C) = class C extends D {C f; K M} m is not deﬁned in M mbody(m, C) = mbody(m, D) We call a Featherweight Java expression e well-typed if Γ g ∈ C can be derived for some environment Γ and some class C. Igarashi, Pierce and Wadler [24] prove that if an FJ program is well-typed, then the only way it can get stuck is if it reaches a point where it cannot perform a downcast. This is stated in the following theorem about progress. Theorem 4. Suppose e is a well-typed expression. 1. If the expression e is of the form new C0 (e).f or contains such a subexpression, then ﬁelds(C0 ) = D f and f ∈ f. 2. If e is of the form new C0 (e).m(d) or contains such a subexpression, then mbody(m, C0 ) = (x, e0 ) and +(x) = +(d).

4

The Object Model

In this section we present the object model of Castagna, Ghelli and Longo [8,10] which will be employed to interpret Featherweight Java in explicit mathematics. In his book [8], Castagna introduces a kernel object-oriented language KOOL and deﬁnes its semantics via an interpretation in a meta-language λ object for which an operational semantics is given. Our construction will be very similar in spirit to Castagna’s interpretation, although we will have to solve many new problems since we start with an already existing language and will end up with a recursion-theoretic model for it. In the object model we use, the state of an object is separated from its methods. Only the ﬁelds of an object are bundled together as one unit, whereas the methods of an object are not encapsulated inside it. Indeed, methods are implemented as branches of global overloaded functions. If a message is sent to an object, then this message determines a function and this function will be applied to the receiving object. However, messages are not ordinary functions. For if the same message is sent to objects of diﬀerent classes, then diﬀerent methods may be retrieved, i.e. diﬀerent code may be executed. Hence, messages represent overloaded functions: depending on the type of their argument (the object the message is passed to), a diﬀerent method is chosen. Since this selection of the method is based on the dynamic type of the object, i.e. its type at run-time, we also have to deal with late-binding. In our semantics of FJ, objects are modeled as pairs (type, value). This encoding of objects was proposed by Castagna [8] in order to interpret late-binding. The value component will be a record consisting of all the ﬁelds of the object and the type component codes the run-time type of the object. All the methods with the same name, although maybe deﬁned in diﬀerent classes, are combined to one overloaded function which takes the receiving object as an additional argument. Hence, the type information contained in the interpretation of the receiving object can be used to resolve this overloaded application, i.e. to select

216

T. Studer

the code to be executed. Since methods may be deﬁned recursively, the interpreting function has to be given by recursion, too. As we will see later, in order to obtain a sound model with respect to typing, we even need a least ﬁxed point operator for the deﬁnition of the semantics of methods. Since several methods may call each other by mutual recursion, we have to give their interpretation using one recursive deﬁnition treating all methods in one go. As Castagna [8] notices, even λ calculi with overloading and late-binding do not posses enough structure to reason about object-oriented programs. Hence he introduces the meta-language λ object which is still based on overloading and late-binding but which also is enriched with new features (e.g. commands to deﬁne new types or to handle the subtyping hierarchy) that are necessary to reproduce the constructs of a programming language. Therefore λ object is an appropriate tool for representing object-oriented programs. However, in λ object it is not possible to state (or even prove) properties of these programs. Our theories of types and names have much more expressive power. They provide not only an axiomatic framework for representing programs, but also for stating and proving properties of programs. Nevertheless, from a proof-theoretic point of view they are quite weak (only a bit stronger than Peano Arithmetic) as demanded by Feferman [15,16,17] or Turner [44]. In its general form overloading and late-binding seem to be proof-theoretically very strong, cf. Studer [37]. However, our work shows that in order to model real object-oriented programming languages we do not need the full power of these principles; as already mentioned by Castagna, Ghelli and Longo [8,10] a predicative variant suﬃces for our practical purposes. Last but not least, the theory of types and names we use in this paper has a standard recursion-theoretic model. Hence, our interpretation of FJ in explicit mathematics shows how computations in Featherweight Java can be seen as ordinary mathematical functions and the interpretation of the classes will be given by sets in the usual mathematical sense.

5

Evaluation Strategy and Typing

Now we study some examples written in Featherweight Java which will motivate our semantics for FJ as presented in the next section. We will focus on Java’s evaluation strategy and on typing issues. In the last example the interplay of free variables, static types and late-binding is investigated. Java features a call-by-value evaluation strategy, cf. the Java language speciﬁcation by Gosling, Joy and Steele [22]. This corresponds to the strictness axioms of the logic of partial terms upon which explicit mathematics is built. They imply that an application only has a value, i.e. is terminating, if all its arguments have a value. In Java we not only have non-terminating programs we also have run-time exceptions, for example when an illegal down cast should be performed. With respect to these features, Featherweight Java is much more coarse grained. There is no possibility to state that a program terminates and exceptions are completely

Constructive Foundations for Featherweight Java

217

ignored. For good reasons, as we should say, since it is intended as a minimal core calculus for modeling Java’s type system. However, this lack of expressiveness has some important consequences which will be studied in the sequel. Let us ﬁrst look at the following example. Example 1. class A extends Object { A () { super(); } C m() { return this.m(); } } class C extends Object { int x; A y; C (int a,A b) { super(); this.x = a; this.y = b; } } Of course, new A().m() is a non-terminating loop. Although, if it is evaluated on an actual Java implementation, then we get after a short while a java.lang.StackOverflowError because of too many recursive method calls. In Featherweight Java new A().m() has no normal form which reﬂects the fact that it loops forever. Now let e be the expression new C(5,new A().m()).x. Due to Java’s call-byvalue evaluation strategy, the computation of this expression will not terminate either, for new A().m() is a subexpression of e and has therefore to be evaluated ﬁrst. The operational semantics of Featherweight Java uses a non-deterministic small-step reduction relation which does not enforce a call-by-value strategy. Hence we have two diﬀerent possibilities for reduction paths starting from e. If we adopt a call-by-value strategy, then we have to evaluate new A().m() ﬁrst and we obtain an inﬁnite reduction path starting from e. Since FJ’s reduction relation is non-deterministic we also have the possibility to apply the computation rule for ﬁeld access. If we decide to do so, then e reduces to 5 which is in normal form. In theories of types and names we have the possibility to state that a computation terminates. The formula t↓ expresses that t has a value, meaning the computation represented by t is terminating. Let [[e]] be the interpretation of the expression e. In our mathematical model Java’s call-by-value strategy is implemented by the strictness axioms, hence ¬[[e]]↓ will be provable. Since 5 surely has a value we obtain [[e]] 5 although 5 is the normal form of e. This means that

218

T. Studer

in our interpretation we cannot model the non-deterministic reduction relation of Featherweight Java but we will implement a call-by-value strategy. Non-terminating programs are not the only problem in modeling computations of Java. A second problem is the lack of a notion of run-time exception in Featherweight Java. For example, if a term is in normal form, then we cannot tell, whether this is the case because the computation ﬁnished properly, or because an illegal down-cast should be performed. It may even be the case that the ﬁnal expression does not contain any down-casts at all, but earlier during the computation an exception should have been thrown. Let us illustrate this fact with the following example, where the class C is as in Example 1. Example 2. class main extends Object{ public static void main (String arg[]) { System.out.println(new C(5,(A)(new Object())).x); } } If we run this main method, then Java throws the following exception: java.lang.ClassCastException: java.lang.Object at main.main(main.java:4) Whereas in Featherweight Java the expression new C(5,(A)(new Object())).x reduces to 5. This is due to the fact that the term (C)(new Object()), which causes the exception in Java, is treated as ﬁnal value in Featherweight Java and therefore it can be used as argument in further method calls. In our model we will introduce a special value ex to denote the result of a computation which throws an exception. An illegal down cast produces (ex, 0) as result and we can check every time an expression is used as argument in a method invocation or in a constructor call whether its value is (ex, 0) or not. If it is not, then the computation can continue; but if an argument value represents an exception, then the result of the computation is this exception value. Therefore in our model we can distinguish whether an exception occurred or not. For example, the above expression evaluates to (ex, 0). We will have [[(A)(new Object())]] = cast A∗ [[new Object()]] = cast A∗ (Object∗ , 0) = (ex, 0) since sub(Object∗ , A∗ ) = 1, i.e. Object is not a subclass of A. Later, we will deﬁne the operation ∗ so that if A is a name for a class, then A∗ is a numeral in L. Then we deﬁne a term sub which decides the subclass relation. That is for two class names A and B, we have sub(A∗ , B∗ ) = 1 if and only if A is a subclass of B. The term cast will be used to model casts. If o is the interpretation of an

Constructive Foundations for Featherweight Java

219

object and A is a class to which this object should be casted, then cast A∗ o is the result of this cast. The term cast uses sub to decide whether it is a legal cast. If it is not, as in the above example, the cast will return (ex, 0). From these considerations it follows that we cannot prove soundness of our model construction with respect to reductions as formalized in Featherweight Java. However, we are going to equip FJ with a restricted reduction relation −→ which enforces a call-by-value evaluation strategy as it is used in the Java language and which also respects illegal down casts. With respect to this new notion of reduction we will be able to prove that our semantics adequately models FJ computations. In Featherweight Java we cannot talk about the termination of programs. As usual in type systems for programming languages the statement “expression e has type T” has to be read as “if the computation of e terminates, then its result is of type T”. Let A be the class of Example 1. Then in FJ new A().m() ∈ C is derivable, although the expression new A().m() denotes a non-terminating loop. Hence in our model we will have to interpret e ∈ C as [[e]]↓ → [[e]] ∈ [[C]]. As we have seen before, the computation of e may result in an exception. In this case we have [[e]] = (ex, 0) which is a deﬁned value. Hence, by our interpretation of the typing relation, we have to include (ex, 0) to the interpretation of every type. In the following we consider a class B which is the same as A except that the result type of the method m is changed to D. class A extends Object { A () { super(); } C m() { return this.m(); } } class B extends Object { B () { super(); } D m() { return this.m(); } } Since the method bodies for m are the same in both classes A and B we can assume that the interpretations of (new A()).m() and (new B()).m() will be the same, that is [[new A().m()]] [[new B().m()]]. In this example the classes C and D may be chosen arbitrarily. In particular, they may be disjoint, meaning that maybe, there is no object belonging to both of them. Hence, if our modeling of the typing relation is sound, it follows that we are in the position to prove that the computation of new B().m() is nonterminating, that is ¬[[(new B()).m()]]↓.

220

T. Studer

Usually, in lambda calculi such recursive functions are modeled using a ﬁxed point combinator. In continuous λ-models, such as Pω or D∞ , these ﬁxed point combinators are interpreted by least ﬁxed point operators and hence one can show that certain functions do not terminate. In applicative theories on the other hand, recursive equations are solved with the rec term provided by the recursion theorem. Unfortunately, one cannot prove that this operator yields a least ﬁxed point; and hence, it is not provable that certain recursive functions do not terminate. Therefore we have to employ the special term l to deﬁne the semantics of FJ expressions. Since this term provides a least solution to certain ﬁxed point equations, it will be possible to show ¬[[(new B()).m()]]↓ which is necessary for proving soundness of our interpretation with respect to typing. Now we are going to examine the role of free variables in the context of static types and late-binding. In the following example let C be an arbitrary class with no ﬁelds. Example 3. class A extends Object{ A () { super(); } C m() { return this.m(); } } class B extends A{ B () { super(); } C m() { return new C(); } } As in Example 1 class A deﬁnes the method m which does not terminate. Class B extends A, hence it is a subclass of A, and it overrides method m. Here m creates a new object of type C and returns it to the calling object. Let x be a free variable with (static) type A. The rules for method typing guarantee that the return type of m cannot be changed by the overriding method; and by the typing rules of FJ we can derive x:A x.m() ∈ C. As we have seen before this means “if x.m() yields a result, then it belongs to C.” Indeed, as a consequence of Java’s late-binding evaluation strategy, knowing only the static type A of x we cannot tell whether in x.m() the method m deﬁned in class A or the one of class B will be executed. Hence we do not know whether this computation terminates or not. Only if we know the object which is referenced by x we can look at its dynamic type and then say, by the rules of method body lookup, which method actually gets called. This behavior has the consequence that there are FJ expression in normal form whose interpretation will not have a value. For example, x.m() is in normal form, but maybe x references an object of type A and in this case the

Constructive Foundations for Featherweight Java

221

interpretation of x.m() will not have a value. Therefore we conclude that only the interpretation of a closed term in normal form will always be deﬁned.

6

Interpreting Featherweight Java

Assume we are given a program written in Featherweight Java. This consist of a ﬁxed class table CT and an expression e. In this section we will show how to translate such a program into the language of types and names. This allows us to state and prove properties of FJ programs. In the sequel we will work with the theory PTN of explicit mathematics. We generally assume that all classes and methods occurring in our ﬁxed class table CT are well-typed. This means for every class C of CT we can derive class C . . . OK by the rules for class typing and for every method m deﬁned in this class we can derive . . . m . . . OK IN C by the rules for method typing. The basic types of Java such as boolean, int, . . . are not included in FJ. However, EETJ provides a rich type structure which is well-suited to model these basic data types, cf. e.g. Feferman [15] or J¨ager [27]. Hence we will include them in our modeling of Featherweight Java. Let ∗ be an injective mapping from all the names for classes, basic types, ﬁelds and methods occurring in the class table CT into the numerals of L. This mapping will be employed to handle the run-time type information of FJ terms as well as to model ﬁeld access and method selection. First we show how objects will be encoded as sequences in our theory of types and names. Let C be a class of our class table CT with f ields(C) = D1 g1 , . . . , Dn gn and let mC be the least natural number such that for all ﬁeld names gj occurring in f ields(C) we have gj ∗ < mC . An object of type C will be interpreted by a sequence (C∗ , (s1 , . . . , smC )), where si is the interpretation of the ﬁeld gj if i = gj ∗ and si = 0 if there is no corresponding ﬁeld. In particular, we always have smC = 0. Note that in this model the type of an object is encoded in the interpretation of the object. We have to ﬁnd a way for dealing with invalid down casts. What should be the value of (A) new Object() in our model, when A is a class diﬀerent from Object? In FJ the computation simply gets stuck, no more reductions will be performed. In our model we choose a natural number ex which is not in the range of ∗ and set the interpretation of illegal down casts to (ex, 0). This allows us to distinguish them from other expressions using deﬁnition by cases on the natural numbers. Hence, every time when an expression gets evaluated we can check whether one of its arguments is the result of an illegal cast. This is the reason why we will have to add run-time type information to elements of basic types, too. Let us look for example at the constant 17 of Java which surely is of type int. If it is simply modeled by the L term 17, then it might happen that 17 = (ex, 0) and we could not decide whether this L term indicates that an illegal down cast occurred or whether it denotes the constant 17 of Java. On the other hand, if the Java constant 17 is modeled by (int∗ , 17),

222

T. Studer

i.e. with run-time type information, then it is provably diﬀerent from (ex, 0). The next example illustrates the coding of objects. Example 4. Assume we have the following class modeling points. class Point extends Object{ int x; int y;

}

Point (int a, int b) { super(); this.x = a; this.y = b; }

Assume ∗ is such that x∗ = 1 and y∗ = 3. Hence, we have mPoint = 4 An object of the class Point where x=5 and y=6 is now modeled by by the sequence (Point∗ , ((int∗ , 5), 0, (int∗ , 6), 0)). In order to deal with the subtype hierarchy of FJ, we deﬁne a term sub modeling the subtype relation. Deﬁnition 3 (of the term sub). Let the term sub be so that for all a, b ∈ N we have: 1. If a or b codes a basic type, e.g. a = A∗ for a basic type A, and a = b, then sub(a, b) = 1. 2. If C <: D can be derived for two classes C and D and C∗ = a as well as D∗ = b hold, then sub(a, b) = 1. 3. Otherwise we set sub(a, b) = 0. Since CT is ﬁnite, sub can be deﬁned using deﬁnition by cases on the natural numbers; recursion is not needed. In the following, we will deﬁne a semantics for expression of Featherweight Java. In a ﬁrst step, this semantics will be given only relative to a term invk which is used to model method calls. As we have shown in our discussion of the object model, we can deﬁne invk in a second step as the least ﬁxed point of a recursive equation involving all methods occurring in our ﬁxed class table. Of course, if at some stage of a computation an invalid down cast occurs and we obtain (ex, 0) as intermediate result, then we have to propagate it to the end of the computation. Therefore all of the following terms are deﬁned by distinguishing two cases: if none of the arguments equals (ex, 0), then the application will be evaluated; if one of the arguments is (ex, 0), then the result is also (ex, 0). We we deﬁne a term proj in order to model ﬁeld access. Deﬁnition 4 (of the term proj). Let the term proj be so that x p0 x = ex, proj i x p0 (tail i (p1 x)) otherwise,

Constructive Foundations for Featherweight Java

223

where tail is deﬁned by primitive recursion such that tail 1 s s

tail (n + 1) s p1 (tail n s)

for all natural numbers n ≥ 1. Hence for i ≤ n and t = ex we have proj i (t, (s1 , . . . , sn , sn+1 )) si . Next, we show how to deﬁne the interpretation of the keyword new. Deﬁnition 5 (of the term new). For every class C of our class table CT with f ields(C) = D1 g1 , . . . , Dn gn we ﬁnd a closed L term tC such that: 1. If ai ↓ holds for all ai (i ≤ n) and if there is a natural number j such that p0 aj = ex, then we get tC (a1 , . . . , an ) = aj where j is the least number satisfying p0 aj = ex. 2. Else we ﬁnd tC (a1 , . . . , an ) (C∗ , (b1 , . . . , bmC )), where bi aj if there exists j ≤ n with i = gj ∗ and bi = 0 otherwise. Using deﬁnition by cases on the natural numbers we can build a term new so that new C∗ (s) tC (s) for every class C in CT . The next example shows how the terms tC work. Example 5. Consider the class Point of Example 4. We get tPoint ((int∗ , 5), (int∗ , 6)) (Point∗ , ((int∗ , 5), 0, (int∗ , 6), 0)) and tPoint ((int∗ , 5), (ex, 0)) (ex, 0). If b is a term so that ¬b↓ holds, then we get ¬tPoint (a, b)↓ by strictness even if a = (ex, 0). The strictness principle of explicit mathematics implies Java’s call-by-value strategy. Again, using deﬁnition by cases we build a term cast. Deﬁnition 6 (of the term cast). Let the term cast be so that (ex, 0) sub(p0 b, a) = 0, cast a b b otherwise. Now, we give the translation [[e]]invk of a Featherweight Java expression e into an L term relative to a term invk.

224

T. Studer

Deﬁnition 7 (of the interpretation [[e]]invk relative to invk). For a sequence e = e1 , . . . , en we write [[e]]invk for [[e1 ]]invk , . . . , [[en ]]invk . We assume that for every variable x of Featherweight Java there exists a corresponding variable x of L such that two diﬀerent variables of FJ are mapped to diﬀerent variables of L. In particular, we suppose that our language L of types and names includes a variable this so that [[this]]invk = this. [[x]]invk := x [[e.f]]invk := proj f∗ [[e]]invk [[e.m(f)]]invk := invk(m∗ , [[e]]invk , [[f]]invk ) [[new C(e)]]invk := new C∗ ([[e]]invk ) [[(C)e]]invk := cast C∗ [[e]]invk In the following we are going to deﬁne the term invk which models method calls. To this aim, we have to deal with overloading and late-binding in explicit mathematics, cf. Studer [37,39]. Deﬁnition 8 (of overloaded functions). Assume we are given n natural numbers s1 , . . . , sn . Using sub we build for each j ≤ n a term minjs1 ,... ,sn such that for all natural numbers s we have minjs1 ,... ,sn (s) = 0 ∨ minjs1 ,... ,sn (s) = 1 and minjs1 ,... ,sn (s) = 1 if and only if sub(s, sj ) = 1 ∧

(sub(s, sl ) = 1 → sub(sl , sj ) = 0).

1≤l≤n l=j

Hence, minjs1 ,... ,sn (s) = 1 holds if sj is a minimal element (with respect to sub) of the set {si | sub(s, si ) = 1 ∧ 1 ≤ i ≤ n}; and otherwise we have minjs1 ,... ,sn (s) = 0. We can deﬁne a term overs1 ,... ,sn which combines several functions f1 , . . . , fn to one overloaded function overs1 ,... ,sn (f1 , . . . , fn ) such that  f1 (x, y )     .  .   . overs1 ,... ,sn (f1 , . . . , fn ) (x, y ) fn (x, y )         (ex, 0)

min1s1 ,... ,sn (p0 x) = 1, minns1 ,... ,sn (p0 x) = 1 minis1 ,... ,sn (p0 x) = 1,

i
p0 x = ex.

Next, we deﬁne the term r which gives the recursive equation which will be solved by invk. Deﬁnition 9 (of the term r). Assume the method m is deﬁned exactly in the classes C1 , . . . , Cn and mbody(m, Ci ) = (xi , ei ) for all i ≤ n. Assume further that xi is x1 , . . . , xz , then we can deﬁne an L term geinvk so that we have for i b = b1 , . . . , bz :

Constructive Foundations for Featherweight Java

225

1. If a↓ and b↓ hold and if there is a natural number j such that p0 bj = ex, then we get geinvk (a, b) = bj where j is the least number satisfying p0 bj = ex. i invk 2. Else we ﬁnd gei (a, b) (λthis.λ[[xi ]]invk .[[ei ]]invk )ab. We see that the terms geinvk depend on invk. Now we let the L term r be such that i for every method m in our class table CT we have )(x, y ). , . . . , geinvk r invk(m∗ , x, y ) overC∗1 ,... ,C∗n (geinvk n 1

(4)

We deﬁne the term invk to be the least ﬁxed point of r. Deﬁnition 10 (of the term invk). We set invk := l r. In the following we will write only [[e]] for the translation of an expression e relative to the term r invk deﬁned as above. It remains to deﬁne the interpretation of Featherweight Java classes. Let us begin with the basic types. The example of the type boolean will show how we can use the type structure of explicit mathematics to model the basic types of Java. If we let 0 and 1 denote “false” and “true”, respectively, then the interpretation [[boolean]] of the basic type boolean is given by {(boolean∗ , b) | b = 0 ∨ b = 1}. Here we see that an element x ∈ [[boolean]] is pair whose ﬁrst component carries the run-time type information of x, namely boolean∗ , and whose second component is the actual truth value. For the Java expressions false and true we can set [[false]] = (boolean∗ , 0)

[[true]] = (boolean∗ , 1).

We will interpret the classes of FJ as ﬁxed point types in explicit mathematics satisfying the following ﬁxed point speciﬁcation. Deﬁnition 11 (of the ﬁxed point FP). If the class table CT contains a class named C with C∗ = i, then the following formula is included in our speciﬁcation: (X)i = Yi1 × · · · × YimC , where mC is again the least natural number such that for all ﬁeld names f occurring in ﬁelds(C) we have f∗ < mC . Yij is deﬁned according to the following three clauses: 1. If there is a basic type D and a ﬁeld name f such that D f belongs to ﬁelds(C), then Yif∗ is equal to the interpretation of D. 2. If there is a class D and a ﬁeld name f such that D f belongs to ﬁelds(C) and if E1 , . . . , En is the list of all classes Ej in CT for which Ej <: D is derivable, then Yif∗ = {(E∗1 , x) | x ∈ (X)E∗1 } ∪ · · · ∪ {(E∗n , x) | x ∈ (X)E∗n } ∪ {(ex, 0)}.

226

T. Studer

3. If there is no ﬁeld name f occurring in ﬁelds(C) so that f∗ = j, then Yij is the universal type V, in particular we ﬁnd YimC = V. As we have shown before, in PTN there provably exists a ﬁxed point FP satisfying the above speciﬁcation. Since our ﬁxed class table CT contains only ﬁnitely many classes we can set up the following deﬁnition for the interpretation [[C]] of a class C. Deﬁnition 12 (of the interpretation [[C]] of a class C). If E1 , . . . , En is the list of all classes Ei in FJ for which Ei <: C is derivable, then [[C]] = {(E∗1 , x) | x ∈ (FP)E∗1 } ∪ · · · ∪ {(E∗n , x) | x ∈ (FP)E∗n } ∪ {(ex, 0)}. We include the value (ex, 0) to the interpretation of all classes because this simpliﬁes the presentation of the proofs about soundness with respect to typing. Of course we could exclude (ex, 0) from the above types, which would be more natural, but then we had to treat it as special case in all the proofs. Now we will present to examples for the deﬁnition of classes. Example 6. We take the class Point given in Example 4 and extend it to a class ColorPoint. class ColorPoint extends Point{ String color;

}

ColorPoint (int a, int b, String c) { super(a,b); this.color = c; }

Assume ∗ is such that color∗ = 4. Hence, we have mColorPoint = 5 Consider an object of the class ColorPoint with x=5, y=6 and color="black" where the string "black" is modeled by say 256. This object is now interpreted by the sequence (Point∗ , ((int∗ , 5), 0, (int∗ , 6), (String, 256), 0)). Since the Point belongs to our class table, the ﬁxed point speciﬁcation contains a line (X)Point∗ = [[int]] × (V × ([[int]] × V)). We obtain that the value of our colored point object ((int∗ , 5), (0, ((int∗ , 6), ((String, 256), 0)))) belongs to the interpretation of Point since ((String, 256), 0) ∈ V. This example illustrates why we take the product with V in the interpretation of objects. It guarantees that the model is sound with respect to subtyping, see Theorem 6 below. This encoding of objects in records is due to Cardelli.

Constructive Foundations for Featherweight Java

227

The next example shows why we have to employ ﬁxed points to model the classes. Example 7. Consider a class Node pointing to a next Node. class Node extends Object{ Node next;

}

Node(Node x){ super(); this.next=x; }

This class will be interpreted as ﬁxed point of X = ({(Node∗ , x) | x ∈ X} ∪ {(ex, 0)}) × V. Iterating this operator form will yield a ﬁxed point only after ω many steps. Therefore, one has to employ dependent choice in the construction of the ﬁxed points modeling classes.

7

Soundness Results

In this section we will prove that our model for Featherweight Java is sound with respect to subtyping, typing and reductions. We start with a theorem about soundness with respect to subtyping which is a trivial consequence of the interpretation of classes. Theorem 5. For all classes C and D of the class table with C <: D it is provable in PTN that [[C]] ⊂ [[D]]. The soundness of the semantics of the subtype relation does not depend on the fact that a type is interpreted as the union of all its subtypes. As the next theorem states, our model is sound with respect to subtyping if we allow to coerce the run-time type of an object into a super type. Coercions are operations which change the type of an object. In models of object-oriented programming these constructs can be used to give a semantics for features which are based on earlybinding, cf. Castagna, Ghelli and Longo [8,9]. This is achieved by coercing the type of an object into its static type before selecting the best matching branch. In Java for example, the resolution of overloaded methods is based on static types, i.e. the choice of the function to be applied is based on early-binding. Theorem 6. For all classes C and D with C <: D the following is provable in PTN: x ∈ [[C]] ∧ p0 x = ex → (D∗ , p1 x) ∈ [[D]].

228

T. Studer

Proof. By induction on the length of the derivation of C <: D we show that (FP)C∗ ⊂ (FP)D∗ . The only non-trivial case is, when the following rule has been applied CT (C) = class C extends D {. . . } C <: D . So we assume CT (C) = class C extends D {. . . }. By our deﬁnition of FP we obtain (FP)C∗ = YC∗ 1 × · · · × YC∗ mC and (FP)D∗ is of the form YD∗ 1 ×· · ·×YD∗ mD . By the rules for ﬁeld lookup we know that if ﬁelds(D) contains E g, then E g also belongs to ﬁelds(C). Therefore we have mD ≤ mC and for all i < mD we get YC∗ i ⊂ YD∗ i by the ﬁxed point speciﬁcation for FP and our general assumption that class typing is ok. Moreover, we obviously have YC∗ mD × · · · × YC∗ mC ⊂ YD∗ mD = V. Therefore, we conclude that the claim holds.

Before proving soundness with respect to typing we have to show some preparatory lemmas. Deﬁnition 13. If D is the list D1 , . . . , Dn , then [[D]] stands for [[D1 ]] × · · · × [[Dn ]]; and if e = e1 , . . . en , then [[e]]invk ∈ [[D]] means ([[e1 ]]invk , . . . , [[en ]]invk ) ∈ [[D1 ]] × · · · × [[Dn ]]. For Γ = x1 : D1 , . . . , xn : Dn we set [[Γ ]]invk := [[x1 ]]invk ∈ [[D1 ]] ∧ · · · ∧ [[xn ]]invk ∈ [[Dn ]]. Deﬁnition 14. We deﬁne the type T to be the intersection of all the types ({m∗ } × [[C]] × [[D]]) [[B]] for all methods m and all classes C occurring in CT with mtype(m, C) = D → B. The next lemma states that if we have an interpretation relative to a function h belonging to T , then this interpretation is sound with respect to typing. Lemma 1. If Γ e ∈ C is derivable in FJ, then we can prove in PTN that h ∈ T implies [[Γ ]]h ∧ [[e]]h ↓ → [[e]]h ∈ [[C]]. Proof. Proof by induction on the derivation length of Γ e ∈ C. We assume [[Γ ]]h ∧ [[e]]h ↓ and distinguish the diﬀerent cases for the last rule in the derivation of Γ e ∈ C:

Constructive Foundations for Featherweight Java

229

1. Γ x ∈ Γ (x): trivial. 2. Γ e.fi ∈ Ci : [[e.fi ]]h ↓ implies [[e]]h ↓ by strictness. Hence, we get by the induction hypothesis [[e]]h ∈ [[C0 ]] and ﬁelds(C0 ) = C f. By the deﬁnition of [[C0 ]] this yields proj f∗i [[e]]h ∈ [[Ci ]]. Finally we conclude by proj f∗i [[e]]h [[e.fi ]]h that the claim holds. 3. Γ e0 .m(e) ∈ C: by the induction hypothesis and Theorem 5 we obtain [[e]]h ∈ [[C]] ⊂ [[D]] and [[e0 ]]h ∈ [[C0 ]]. Moreover, we have mtype(m, C0 ) = D → C. Hence we conclude by h ∈ T and [[e0 .m(e)]]h h(m∗ , [[e0 ]]h , [[e]]h ) that the claim holds. 4. Γ new C(e) ∈ C: by the induction hypothesis and Theorem 5 we have [[e]]h ∈ [[C]] ⊂ [[D]]. Further we know ﬁelds(C) = D f. Therefore the claim holds by the deﬁnition of new. 5. If the last rule was an upcast, then the claim follows immediately from the induction hypothesis, the deﬁnition of the term cast and Theorem 5. 6. Assume the last rule was a downcast or a stupid cast. By the induction hypothesis we get [[e]]h ∈ [[D]]. Then D <: C implies sub(p0 [[e]]h , C∗ ) = 0. We get [[(C)e]]h (ex, 0) by the deﬁnition of cast. Hence the claim holds. The following lemma says that our interpretation of FJ expressions is in accordance with the deﬁnedness ordering T . Lemma 2. If Γ e ∈ C is derivable in FJ, then we can prove in PTN that g, h ∈ T and g T h imply [[Γ ]]g ∧ [[e]]g ↓ → [[e]]g = [[e]]h . Proof. Proof by induction on the derivation length of Γ e ∈ C. Assume [[Γ ]]g and [[e]]g ↓ hold. We distinguish the following cases: 1. Γ x ∈ Γ (x): trivial. 2. Γ e0 .fi ∈ Ci : we know Γ e0 ∈ C0 . Hence we get by the induction hypothesis [[e0 ]]g = [[e0 ]]h and therefore the claim holds. 3. Γ e0 .m(e) ∈ C: we get Γ e0 ∈ C0 , Γ e ∈ C and mtype(m, C0 ) = D → C

as well as

C <: D.

(5)

Because of [[e]]g ↓ we obtain [[e0 ]]g ↓ and [[e]]g ↓. Hence the induction hypothesis yields [[e0 ]]g = [[e0 ]]h as well as [[e]]g = [[e]]h . Using Lemma 1, we get [[Γ ]]g [[e0 ]]g ∈ [[C0 ]], [[Γ ]]g [[e]]g ∈ [[C]] as well as [[Γ ]]g [[e]]g ∈ [[C]]. With (5), g ∈ T , h ∈ T and g T h we conclude [[e0 .m(e)]]g = g(m∗ , [[e0 ]]g , [[e]]g ) = h(m∗ , [[e0 ]]h , [[e]]h ) = [[e0 .m(e)]]h 4. Γ new C(e) ∈ C: as in the second case, the claim follows immediately from the induction hypothesis.

230

T. Studer

5. If the last rule was a cast, then again the claim is a direct consequence of the induction hypothesis. Remark 1. In the logic of partial terms it is provable that ∀xF ∧ t↓ → F [t/x] for all formulas F of L, cf. e.g. Beeson [5]. Now, we want to show that invk ∈ T . First we prove r ∈ (T → T ). Lemma 3. In PTN it is provable that r ∈ (T → T ). ∈ ({m∗ } × [[C0 ]] × [[D]]) for a method m and Proof. Assume h ∈ T and let (m∗ , c, d) classes C0 , D, C with mtype(m, C0 ) = D → C. We have to show → rh(m∗ , c, d) ∈ [[C]]. rh(m∗ , c, d)↓ By (4) we ﬁnd So assume rh(m∗ , c, d)↓. = overC∗ ,... ,C∗ (g h , . . . , g h )(c, d). rh(m∗ , c, d) e1 en n 1 = (ex, 0) and the claim holds. Hence, if c = (ex, 0) then we obtain rh(m∗ , c, d) If c = (ex, 0) then we get sub(p0 c, C0 ) = 1. By our interpretation of classes, there exists a class B such that B <: C0 , p0 c = B∗ as well as c ∈ [[B]]. Let mbody(m, B) = (xi , ei ). Hence we have = g h (c, d) = [[ei ]]h [c/this, d/ xi ]. r h (m∗ , c, d) ei

(6)

By the rules for method body lookup there exists a class A such that B <: A <: C0 and the method m is deﬁned in A by the expression ei . By our general assumption that method typing is ok we obtain x : D, this : A ei ∈ E0

E0 <: C.

(7)

By Theorem 5 we get c ∈ [[A]] and therefore we conclude by h ∈ T , (6), Lemma ∈ [[C]] holds. 1 and Remark 1 that rh(m∗ , c, d) Now, we prove that r is T monotonic which implies invk ∈ T . Lemma 4. In PTN it is provable that invk ∈ T . Proof. We have deﬁned invk as l r. Lemma 3 states r ∈ (T → T ). Therefore it remains to show that r is T monotonic. Let g, h ∈ T such that g T h. We have to show r g T r h. So assume rg ∈ T . Now we have to show rh ∈ T .

(8)

Constructive Foundations for Featherweight Java

231

Moreover, we have to show for all methods m and classes C0 , D and C with mtype(m, C0 ) = D → C that (∀x ∈ {m∗ } × [[C0 ]] × [[D]])r g x C r h x.

(9)

∈ (8) is a direct consequence of Lemma 3. In order to show (9) we let (m∗ , c, d) ∗ ∗ {m } × [[C0 ]] × [[D]] and r g (m , c, d) ∈ [[C]]. It remains to show = r h (m∗ , c, d). r g(m∗ , c, d)

(10)

xi ] for some i and we have = [[ei ]]g [c/this, d/ As in Lemma 3 we ﬁnd r g (m∗ , c, d) to show that this is equal to [[ei ]]h [c/this, d/xi ]. By (7), which was a consequence of our general assumption that method typing is OK, and Lemma 2 we ﬁnd x ∈ [[D]] ∧ this ∈ [[C0 ]] → [[ei ]]g = [[ei ]]h . Hence by Remark 1 we obtain xi ] = [[ei ]]h [c/this, d/ xi ] [[ei ]]g [c/this, d/ and we ﬁnally conclude that (10) holds.

The next theorem states that our model is sound with respect to typing. Theorem 7. If Γ e ∈ C is derivable in FJ, then in PTN it is provable that [[Γ ]] ∧ [[e]]↓ → [[e]] ∈ [[C]]. Proof. By the previous lemma we obtain invk ∈ T and therefore r invk ∈ T by Lemma 3. Then we apply Lemma 1 in order to verify our claim. As we have seen in Example 1 we cannot prove soundness with respect to reductions of our model construction for the original formulation of reductions in Featherweight Java. The reason is that FJ does not enforce a call-by-value evaluation strategy whereas theories of types and names adopt call-by-value evaluation via their strictness axioms. Moreover, Examples 2 and 3 show that we also have to take care of exceptions and the role of late-binding. Let −→ be the variant of the reduction relation −→ with a call-by-value evaluation strategy which respects exceptions. Deﬁnition 15. Let a and b be two FJ expressions. We deﬁne the reduction relation −→ by induction on the structure of a: a −→ b if and only if a −→ b, where all subexpressions of a are in closed normal form with respect to −→ and a does not contain subexpressions like (D)new C(e) with C <: D. As shown in Example 3 the following lemma can only be established for closed expressions in normal form. Lemma 5. Let e be a well-typed Featherweight Java expression in closed normal form with respect to −→ . Then in PTN it is provable that [[e]]↓. Moreover, if e is not of the form (D)new C(e) with C <: D and does not contain subexpressions of this form, then it is provable in PTN that p0 [[e]] = ex.

232

T. Studer

Proof. Let e be a well-typed closed FJ expression in normal form. First, we prove by induction on the structure of e that one of the following holds: e itself is of the form (D)new C(e) with C <: D or it contains a subexpression of this form or e does not contain such subexpressions and e is new C(e) for a class C and expressions e. We distinguish the ﬁve cases for the built up of e as given by the syntax for expressions. 1. x: is not possible since e is a closed term. 2. e0 .f: the induction hypothesis applies to e0 . In the ﬁrst two cases we obtain that e contains a subexpression of the form (D)new C(e) with C <: D. In the last case we get by Theorem 4 about progress that e cannot be in normal form. 3. e0 .m(e): similar to the previous case. 4. new C(e): the induction hypothesis applies to e. Again, we obtain in the ﬁrst two cases that e contains a subexpression of the form (D)new C(e) with C <: D. In the last case we see that e also fulﬁlls the conditions of the last case. 5. (C)e0 : we apply the induction hypothesis to infer that e must satisfy condition one or two since it is in normal form. Now, we know that e satisﬁes one of the three conditions above. In the ﬁrst two cases we obtain by induction on the structure of e that [[e]] = (ex, 0). If the ﬁrst two cases do not apply, then e is built up of new expressions only and we can prove by induction on the structure of e that [[e]]↓ and p0 [[e]] = ex. Our interpretation of FJ expressions respects substitutions. Lemma 6. For all FJ expressions e, d and variables x it is provable in PTN that [[e]][[[d]]/[[x]]] [[e[d/x]]]. Proof. We proceed by induction on the term structure of e. The following cases have to be distinguished. 1. e is a variable, then the claim obviously holds. 2. e is of the form e0 .g. We have [[e0 .g]][[[d]]/[[x]]] (proj g∗ [[e0 ]])[[[d]]/[[x]]]. Since none of the variables of [[x]] occurs freely in proj or g∗ , this is equal to proj g∗ ([[e0 ]][[[d]]/[[x]]]), which equals proj g∗ ([[e0 [d/x]]]) by the induction hypothesis. Finally, we obtain [[e0 .g[d/x]]]. 3. e is of the form e0 .m(e). We have [[e0 .m(e)]][[[d]]/[[x]]] (r invk (m∗ , [[e0 ]], [[e]]))[[[d]]/[[x]]]. Again, since none of the variables of [[x]] occurs freely in r invk or in m∗ this is equal to r invk (m∗ , [[e0 ]][[[d]]/[[x]]], [[e]][[[d]]/[[x]]]). By the induction hypothesis we obtain r invk (m∗ , [[e0 [d/x]]], [[e[d/x]]]), and ﬁnally we get [[e0 .m(e)[d/x]]].

Constructive Foundations for Featherweight Java

233

4. e is of the form new C(e). We have [[new C(e)]][[[d]]/[[x]]] (new C∗ ([[e]]))[[[d]]/[[x]]]. Again this is equal to new C∗ ([[e]][[[d]]/[[x]]]) which is by the induction hypothesis new C∗ ([[e[d/x]]]). This is [[new C(e)[d/x]]] by the interpretation of new. 5. e is of the form (C)e0 . We obtain [[(C)e0 ]][[[d]]/[[x]]] cast C∗ ([[e0 ]][[[d]]/[[x]]]). By the induction hypothesis this is equal to cast C∗ [[e0 [d/x]]] [[(C)e0 [d/x]]].

Now we prove soundness with respect to call-by-value reductions. Theorem 8. Let g, h be two FJ expressions so that g is well-typed and g −→ h is derivable in FJ, then in PTN it is provable that [[g]] [[h]]. Proof. We distinguish the three diﬀerent rules for computations. 1. g is of the form (new C(e)).fi and ﬁelds(C) = C f. We obtain [[(new C(e)).fi ]] proj f∗i [[new C(e)]]. By the deﬁnition of new this is equal to proj f∗i (tC [[e]]). For g −→ h, we know that all subexpressions of g are closed, fully evaluated and not of the form (D)new C(e) with C <: D. Hence we obtain by the Lemma 5 that p0 [[e]] = ex holds and therefore proj f∗i (tC [[e]]) [[ei ]]. 2. g is of the form (new C(e)).m(d) and mbody(m, C) = (x, e0 ). Assume m is deﬁned exactly in the classes C1 , . . . , Cn . Now we show by induction on the length of the derivation of mbody(m, C) = (x, e0 ) that there exists k so that 1 ≤ k ≤ n, minlC∗1 ,... ,C∗n (C∗ ) = 1 (11) minkC∗1 ,... ,C∗n (C∗ ) = 1 l
and mbody(m, C) = mbody(m, Ck ).

(12)

If m is deﬁned in C, then there exists a k in 1, . . . , n so that C = Ck . Hence (11) and (12) trivially hold. If m is not deﬁned in C, then C extends a class B with mbody(m, B) = (x, e0 ). In this case we have mbody(m, C) = mbody(m, B). Therefore (11) and (12) follow by the induction hypothesis. We have assumed that (new C(e)).m(d) is well-typed. Therefore we get that new C(e) and d are well-typed. Let B be the type satisfying mbody(m, C) = mbody(m, B) so that m is deﬁned in B. We ﬁnd C <: B. Furthermore, let D be

234

T. Studer

the types with d ∈ D. The expressions e, d are in closed normal form and hence we obtain by Lemma 5, Theorem 7 and Theorem 5 [[new C(e)]]r invk ∈ [[B]]

[[d]]r invk ∈ [[D]].

(13)

By our general assumption that method typing is ok we obtain x : D, this : B e0 ∈ E0 . Hence applying Lemma 2 with r invk ∼ =T invk yields [[x]]invk ∈ [[D]] ∧ [[this]]invk ∈ [[B]] → [[e0 ]]invk [[e0 ]]r invk .

(14)

Summing up, we get by (13), (14) and Remark 1 [[(new C(e)).m(d)]]r invk r invk (m∗ , [[new C(e)]]r invk , [[d]]r invk ) [[e0 ]]invk ([[new C(e)]]r invk /this, [[d]]r invk /[[x]]) [[e0 ]]r invk ([[new C(e)]]r invk /this, [[d]]r invk /[[x]]). In view of Lemma 6 this is partially equal to [[e0 [new C(e)/this, d/x]]]r invk . 3. g is of the form (D)(new C(e)) and C <: D. We have sub(C∗ , D∗ ) = 1 and therefore [[(D)(new C(e))]] [[new C(e)]].

8

Conclusion

Usually, the research on Java’s semantics takes an operational approach. If a denotational semantics for object-oriented principles is presented, then it is often given in domain-theoretic notions. In contrast to this work, we investigate a denotational semantics for Featherweight Java which is based on recursiontheoretic concepts. Our interpretation of Featherweight Java is based upon a formalization of the object model of Castagna, Ghelli and Longo [10]. Its underlying type theory can be given using predicative notions only, whereas most other object encodings are impredicative, cf. e.g. Bruce, Cardelli and Pierce [7]. We have formalized the object model in a predicative theory of types and names which shows that this model is really simple from a proof-theoretic perspective. Hence, our formalization provides constructive foundations for object-oriented programming. Moreover, this gives further evidence for Feferman’s claim that impredicative assumptions are not needed for computational practice. A claim which has, up to now, only been veriﬁed for polymorphic functional programs. Our work yields

Constructive Foundations for Featherweight Java

235

ﬁrst positive results about its status in the context of object-oriented programming. We have a proof-theoretically weak but highly expressive theory for representing object-oriented programs and for stating and proving many properties of them similar to the systems provided by Feferman [15,16,17] and Turner [43, 44] for functional programming. Due to the fact that a least ﬁxed point operator is deﬁnable in our theory, we also can prove that certain programs will not terminate. This is not possible in the systems of Feferman and Turner. Since Featherweight Java is the functional core of the Java language and since the object model we employ provides a uniﬁed foundation for both Simula’s and CLOS’s style of programming, our work also contributes to the study of the relationship between object-oriented and functional programming. It shows that these two paradigms of programming ﬁt well together and that their combination has a sound mathematical model. Usually, denotational semantics are given in domain-theoretic notions. In such a semantics one has to include to each type an element ⊥ which denotes the result of a non-terminating computation of this type, cf. e.g. Alves-Foss and Lam [2]; whereas our recursion-theoretic model has the advantage that computations are interpreted as ordinary computations. This means we work with partial functions which possibly do not yield a result for certain arguments, i.e. computations may really not terminate. In our opinion this model is very natural and captures well our intuition about non-termination. As already pointed out by Castagna, Ghelli and Longo [10] the dynamic deﬁnition of new classes is one of the main problems when overloaded functions are used to deﬁne methods. Indeed, in our semantics we assumed a ﬁxed class table, i.e. the classes are given from the beginning and they will not change. This fact makes our semantics non-compositional. If we add new classes to our class table, then we get a new interpretation for our objects. An important goal would be to investigate an overloading based semantics for object-oriented programs with dynamic class deﬁnitions. Our work has also shown that theories of types and names are a powerful tool for analyzing concepts of object-oriented programming languages. Therefore, we think it would be worthwhile to employ such theories for exploring further principles, i.e. the combination of overloading and parametric polymorphism, cf. Castagna [8], or the addition of mixins to class-based object-oriented languages, cf. e.g. Ancona, Lagorio and Zucca [3] or Flatt, Krishnamurthi and Felleisen [20]. Last but not least it would be very interesting to have a semantics for concurrent and distributed computations in explicit mathematics.

References 1. Wolfgang Ahrendt, Thomas Baar, Bernhard Beckert, Martin Giese, Elmar Habermalz, Reiner H¨ ahnle, Wolfram Menzel, and Peter H. Schmitt. The KeY approach: integrating object oriented design and formal veriﬁcation. In Gerhard Brewka and Lu´ıs Moniz Pereira, editors, Proc. 8th European Workshop on Logics in AI (JELIA), Lecture Notes in Artiﬁcial Intelligence. Springer, 2000.

236

T. Studer

2. Jim Alves-Foss and Fong Shing Lam. Dynamic denotational semantics of Java. In J. Alves-Foss, editor, Formal Syntax and Semantics of Java, volume 1523 of Lecture Notes in Computer Science, pages 201–240. Springer, 1999. 3. Davide Ancona, Giovanni Lagorio, and Elena Zucca. Jam: A smooth extension of Java with mixins. In E. Bertino, editor, ECOOP 2000 - 14th European Conference on Object-Oriented Programming, volume 1850 of Lecture Notes in Computer Science. Springer, 2000. 4. Davide Ancona and Elena Zucca. A module calculus for Featherweight Java. Submitted. 5. Michael J. Beeson. Foundations of Constructive Mathematics: Metamathematical Studies. Springer, 1985. 6. Michael J. Beeson. Proving programs and programming proofs. In R. Barcan Marcus, G.J.W. Dorn, and P. Weingartner, editors, Logic, Methodology and Philosophy of Science VII, pages 51–82. North-Holland, 1986. 7. Kim B. Bruce, Luca Cardelli, and Benjamin C. Pierce. Comparing object encodings. Information and Computation, 155:108–133, 1999. 8. Giuseppe Castagna. Object-Oriented Programming: A Uniﬁed Foundation. Birkh¨ auser, 1997. 9. Giuseppe Castagna, Giorgio Ghelli, and Giuseppe Longo. A semantics for λ&early: a calculus with overloading and early binding. In M. Bezem and J. F. Groote, editors, Typed Lambda Calculi and Applications, volume 664 of Lecture Notes in Computer Science, pages 107–123. Springer, 1993. 10. Giuseppe Castagna, Giorgio Ghelli, and Giuseppe Longo. A calculus for overloaded functions with subtyping. Information and Computation, 117(1):115–135, 1995. 11. Pietro Cenciarelli, Alexander Knapp, Bernhard Reus, and Martin Wirsing. An event-based structural operational semantics of multi-threaded Java. In J. AlvesFoss, editor, Formal Syntax and Semantics of Java, volume 1523 of Lecture Notes in Computer Science, pages 157–200. Springer, 1999. 12. Sophia Drossopoulou, Susan Eisenbach, and Sarfraz Khurshid. Is the Java type system sound? Theory and practice of object systems, 5(1):3–24, 1999. 13. Solomon Feferman. A language and axioms for explicit mathematics. In J.N. Crossley, editor, Algebra and Logic, volume 450 of Lecture Notes in Mathematics, pages 87–139. Springer, 1975. 14. Solomon Feferman. Constructive theories of functions and classes. In M. Boﬀa, D. van Dalen, and K. McAloon, editors, Logic Colloquium ’78, pages 159–224. North Holland, 1979. 15. Solomon Feferman. Polymorphic typed lambda-calculi in a type-free axiomatic framework. In W. Sieg, editor, Logic and Computation, volume 106 of Contemporary Mathematics, pages 101–136. American Mathematical Society, 1990. 16. Solomon Feferman. Logics for termination and correctness of functional programs. In Y. N. Moschovakis, editor, Logic from Computer Science, volume 21 of MSRI Publications, pages 95–127. Springer, 1991. 17. Solomon Feferman. Logics for termination and correctness of functional programs II: Logics of strength PRA. In P. Aczel, H. Simmons, and S. S. Wainer, editors, Proof Theory, pages 195–225. Cambridge University Press, 1992. 18. Matthias Felleisen and Daniel P. Friedman. A Little Java, A Few Patterns. MIT Press, 1998. 19. Marcello Fiore, Achim Jung, Eugenio Moggi, Peter O’Hearn, Jon Riecke, Giuseppe Rosolini, and Ian Stark. Domains and denotational semantics: history, accomplishments and open problems. Bulletin of the European Association for Theoretical Computer Science, 59:227–256, 1996.

Constructive Foundations for Featherweight Java

237

20. Matthew Flatt, Shriram Krishnamurthi, and Matthias Felleisen. A programmer’s reduction semantics for classes and mixins. Technical report, Rice University, 1999. Corrected Version, original in J. Alvess-Foss, editor, Formal Syntax and Semantics of Java, volume 1523 of Lecture Notes in Computer Science, pages 241– 269, Springer, 1999. 21. Giorgio Ghelli. A static type system for late binding overloading. In A. Paepcke, editor, Proc. of the Sixth International ACM Conference on Object-Oriented Programming Systems and Applications, pages 129–145. Addison-Wesley, 1991. 22. James Gosling, Bill Joy, and Guy Steele. The Java Language Speciﬁcation. Addison Wesley, 1996. Also available via http://java.sun.com/docs/. 23. Atsushi Igarashi and Benjamin Pierce. On inner classes. In Informal Proceedings of the Seventh Internatianal Workshop on Foundations of Object-Oriented Languages (FOOL), 2000. 24. Atsushi Igarashi, Benjamin Pierce, and Philip Wadler. Featherweight Java: A minimal core calculus for Java and GJ. In Object Oriented Programming: Systems, Languages and Applications (OOPSLA ’99), volume 34 of ACM SIGPLAN Notices, pages 132–146, 1999. 25. Bart Jacobs, Joachim van den Berg, Marieke Huisman, Martijn van Berkum, Ulrich Hensel, and Hendrik Tews. Reasoning about Java classes (preliminary report). In Object Oriented Programming: Systems, Languages and Applications (OOPSLA ’98), volume 33 of ACM SIGPLAN Notices, pages 329–340, 1998. 26. Gerhard J¨ ager. Induction in the elementary theory of types and names. In E. B¨ orger, H. Kleine B¨ uning, and M.M. Richter, editors, Computer Science Logic ’87, volume 329 of Lecture Notes in Computer Science, pages 118–128. Springer, 1988. 27. Gerhard J¨ ager. Type theory and explicit mathematics. In H.-D. Ebbinghaus, J. Fernandez-Prida, M. Garrido, M. Lascar, and M. Rodriguez Artalejo, editors, Logic Colloquium ’87, pages 117–135. North-Holland, 1989. 28. Reinhard Kahle. Einbettung des Beweissystems Lambda in eine Theorie von Operationen und Zahlen. Diploma thesis, Mathematisches Institut der Universit¨ at M¨ unchen, 1992. 29. Reinhard Kahle and Thomas Studer. Formalizing non-termination of recursive programs. To appear in Journal of Logic and Algebraic Programming. 30. Tobias Nipkow and David von Oheimb. Javaight is type-safe — deﬁnitely. In Proc. 25th ACM Symp. Principles of Programming Languages. ACM Press, New York, 1998. 31. David von Oheimb. Axiomatic semantics for Javaight . In S. Drossopoulou, S. Eisenbach, B. Jacobs, G. T. Leavens, P. M¨ uller, and A. Poetzsch-Heﬀter, editors, Formal Techniques for Java Programs. Fernuniversit¨ at Hagen, 2000. 32. Dieter Probst. Dependent choice in explicit mathematics. Diploma thesis, Institut f¨ ur Informatik und angewandte Mathematik, Universit¨ at Bern, 1999. 33. Dana S. Scott. Identity and existence in intuitionistic logic. In M. Fourman, C. Mulvey, and D. Scott, editors, Applications of Sheaves, volume 753 of Lecture Notes in Mathematics, pages 660–696. Springer, 1979. 34. Robert St¨ ark. Call-by-value, call-by-name and the logic of values. In D. van Dalen and M. Bezem, editors, Computer Science Logic ’96, volume 1258 of Lecture Notes in Computer Science, pages 431–445. Springer, 1997. 35. Robert St¨ ark. Why the constant ‘undeﬁned’ ? Logics of partial terms for strict and non-strict functional programming languages. Journal of Functional Programming, 8(2):97–129, 1998.

238

T. Studer

36. Robert St¨ ark, Joachim Schmid, and Egon B¨ orger. Java and the Java Virtual Machine. Springer, 2001. {} 37. Thomas Studer. A semantics for λstr : a calculus with overloading and late-binding. To appear in Journal of Logic and Computation. 38. Thomas Studer. Object-Oriented Programming in Explicit Mathematics: Towards the Mathematics of Objects. PhD thesis, Institut f¨ ur Informatik und angewandte Mathematik, Universit¨ at Bern, 2001. 39. Thomas Studer. Impredicative overloading in explicit mathematics. Submitted. 40. Don Syme. Proving Java type soundness. In J. Alves-Foss, editor, Formal Syntax and Semantics of Java, volume 1523 of Lecture Notes in Computer Science, pages 83–118. Springer, 1999. 41. Makoto Tatsuta. Realizability for constructive theory of functions and classes and its application to program synthesis. In Proceedings of Thirteenth Annual IEEE Symposium on Logic in Computer Science, LICS ’98, pages 358–367, 1998. 42. Anne Sjerp Troelstra and Dirk van Dalen. Constructivism in Mathematics, vol II. North Holland, 1988. 43. Raymond Turner. Constructive Foundations for Functional Languages. McGraw Hill, 1991. 44. Raymond Turner. Weak theories of operations and types. Journal of Logic and Computation, 6(1):5–31, 1996.

Author Index

Aehlig, Klaus 1 Alt, Jesse 22 Artemov, Sergei 22

Johannsen, Jan

Baaz, Matthias 38, 49 Berger, Ulrich 68

Matthes, Ralph

153

Oitavem, Isabel

170

Leitsch, Alexander

Doˇsen, Kosta 78 Dybjer, Peter 93 Elbl, Birgit

Petri´c, Zoran

114

Ferm¨ uller, Christian G. Gordeew, Lew

130

1

38

49

78

Schmitt, Peter H. 191 Schwichtenberg, Helmut Setzer, Anton 93 Studer, Thomas 202 Terwijn, Sebastiaan A.

1

1